Critical Sudo Vulnerability Allows Local Users to Gain Root Access
A critical vulnerability has been discovered in the widely-used Linux utility Sudo. The elevation of privilege (EoP) bug, identified as CVE-2025-32463, affects versions 1.9.14 to 1.9.17, including Ubuntu 24.04.1 and Fedora 41 Server. This flaw allows local users to gain full root access by exploiting the chroot function.
The vulnerability highlights significant gaps in digital infrastructure visibility, emphasizing the need for robust security investments. Users are urged to update to Sudo 1.9.17p1 or later to fix this critical issue. A second EoP bug, present for over a decade, has also been found in Sudo versions Stable 1.9.0 to 1.9.17 and Legacy 1.8.8 to 1.8.32. Organizations should prioritize an immediate audit of their environment to identify similar blind spots and patch all vulnerable systems. Notably, the original EoP bug, CVE-2021-3156, was discovered by Qualys in 2021 and affected versions from 1.8.2 to 1.8.31p2 and 1.9.5p1. Users should update to the latest Sudo version to mitigate both issues.
In summary, two critical elevation of privilege vulnerabilities have been found in the popular Linux utility Sudo. The first, CVE-2025-32463, affects recent versions and allows local users to gain root access. The second, CVE-2021-3156, has been present for over a decade and affects a wide range of versions. Users and organizations are advised to update to the latest Sudo version and conduct thorough security audits to protect their systems.
