### Vulnerability Details Two closely related local privilege escalation vulnerabilities (CVE-2025-32462 / CVE-2025-32463) have recently been publicly disclosed in the Linux sudo utility. Under the default configuration of mainstream Linux distributions, attackers can exploit these vulnerabilities to escalate privileges from a regular user to root. CVE-2025-32462 is a local privilege escalation vulnerability in Linux sudo stemming from a flaw in the `-h` (`--host`) option. This option is intended to be used with `-l` (`--list`) to query permissions on remote hosts, but it is not strictly restricted to query-only functionality. As a result, attackers may combine it with command execution or file editing operations to achieve local privilege escalation. CVE-2025-32463 is a local privilege escalation vulnerability in Linux sudo's chroot functionality. When loading the `nsswitch.conf` configuration file from the target location, sudo also loads the corresponding dynamic libraries. An attacker can plant a malicious dynamic library to gain root privileges without being a member of the sudoers group. ### Remediation **Note:** Before installing updates, please back up your data, take snapshots, and perform testing to prevent unexpected issues. **1. Vulnerability CVE-2025-32462** | System | Affected Versions | Fixed Versions | |---|---|---| | sudo Official | sudo 1.8.8 – 1.9.17 | sudo >= 1.9.17p1 | | Ubuntu 24.04 LTS | sudo < 1.9.15p5-3ubuntu5.24.04.1 | sudo >= 1.9.15p5-3ubuntu5.24.04.1 | | Ubuntu 22.04 LTS | sudo < 1.9.9-1ubuntu2.5 | sudo >= 1.9.9-1ubuntu2.5 | | Ubuntu 20.04 LTS | sudo < 1.8.31-1ubuntu1.5+esm1 | sudo >= 1.8.31-1ubuntu1.5+esm1 | | Ubuntu 18.04 LTS | sudo < 1.8.21p2-3ubuntu1.6+esm1 | sudo >= 1.8.21p2-3ubuntu1.6+esm1 | | Ubuntu 16.04 LTS | sudo < 1.8.16-0ubuntu1.10+esm3 | sudo >= 1.8.16-0ubuntu1.10+esm3 | | Ubuntu 14.04 LTS | sudo < 1.8.9p5-1ubuntu1.5+esm8 | sudo >= 1.8.9p5-1ubuntu1.5+esm8 | | Debian 11 | sudo < 1.9.5p2-3+deb11u2 | sudo >= 1.9.5p2-3+deb11u2 | | Debian 12 | sudo < 1.9.13p3-1+deb12u2 | sudo >= 1.9.13p3-1+deb12u2 | | Rocky 9 | sudo < 1.9.5p2-10.el9_6.1.x86_64 | sudo >= 1.9.5p2-10.el9_6.1.x86_64 | | Rocky 8 | sudo < 1.9.5p2-1.el8_10.1.x86_64 | sudo >= 1.9.5p2-1.el8_10.1.x86_64 | | Red Hat Enterprise Linux 10 | Affected | No official fix available yet | | Red Hat Enterprise Linux 9 | sudo < 1.9.5p2-10.el9_6.1.x86_64 | sudo >= 1.9.5p2-10.el9_6.1.x86_64 | | Red Hat Enterprise Linux 8 | sudo < 1.9.5p2-1.el8_10.1.x86_64 | sudo >= 1.9.5p2-1.el8_10.1.x86_64 | | Red Hat Enterprise Linux 7 | Affected | End of life — no official fix | | Red Hat Enterprise Linux 6 | Not affected | — | | CentOS 9 | sudo < 1.9.5p2-10.el9_6.1.x86_64 | sudo-1.9.5p2-10.el9_6.1.x86_64 | | CentOS 8 | Affected | End of life — no official fix | | CentOS 7 | Affected | End of life — no official fix | | CentOS 6 | Not affected | — | **2. Vulnerability CVE-2025-32463** | System | Affected Versions | Fixed Versions | |---|---|---| | sudo Official | sudo 1.9.14 – 1.9.17 | sudo >= 1.9.17p1 | | Ubuntu 24.04 LTS | sudo < 1.9.15p5-3ubuntu5.24.04.1 | sudo >= 1.9.15p5-3ubuntu5.24.04.1 | | Ubuntu 22.04 LTS | Not affected | — | | Ubuntu 20.04 LTS | Not affected | — | | Ubuntu 18.04 LTS | Not affected | — | | Ubuntu 16.04 LTS | Not affected | — | | Ubuntu 14.04 LTS | Not affected | — | | Debian 11 | sudo < 1.9.5p2-3+deb11u1 | sudo >= 1.9.5p2-3+deb11u1 | | Debian 12 | sudo < 1.9.13p3-1+deb12u1 | sudo >= 1.9.13p3-1+deb12u1 | | Rocky 9 | Not affected | — | | Rocky 8 | Not affected | — | | Red Hat Enterprise Linux 10 | Affected | No official fix available yet | | Red Hat Enterprise Linux 9 | Not affected | — | | Red Hat Enterprise Linux 8 | Not affected | — | | Red Hat Enterprise Linux 7 | Not affected | — | | Red Hat Enterprise Linux 6 | Not affected | — | | CentOS 9 | Not affected | — | | CentOS 8 | Not affected | — | | CentOS 7 | Not affected | End of life — no official fix | | CentOS 6 | Not affected | — | 3. UCloud's Host Intrusion Detection System (UHIDS) now supports detection of these vulnerabilities. Detection results can be viewed under **"Security Events" → "Security Vulnerabilities" → "Host Vulnerabilities"**. ### Temporary Mitigations **For CVE-2025-32462:** Check whether the `Host` or `Host_Alias` options are used in the sudoers file: `sudo grep -r "Host\|Host_Alias" /etc/sudoers /etc/sudoers.d/` If these options are found, you can temporarily modify the sudoers file by replacing specific hostnames with `ALL`, or ensure that the sudoers file on each host contains only rules applicable to that host itself. **For CVE-2025-32463:** Since no temporary workaround is available, it is strongly recommended to update to the fixed version immediately. If an immediate update is not possible, consider temporarily disabling sudo's chroot functionality, though this may affect system operations that depend on it. ### References [https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-host](https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-host) [https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot](https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot)

UCloud-202507-001:Linux sudo Local Privilege Escalation Vulnerability Security Advisory