In late June 2025, security researcher Rich Mirch of Stratascale disclosed a critical vulnerability in sudo, the Linux utility used to run commands with elevated privileges. Tracked as CVE‑2025‑32463 and nicknamed “chwoot”, the flaw affects sudo versions 1.9.14 to 1.9.17 and allows any local user to gain root access without needing sudoers permissions. By taking advantage of the `–chroot `(`-R`) option, an attacker can reliably escalate privileges using a simple, low-complexity exploit. This makes the vulnerability a serious concern across many Linux distributions.
Technical Details (Chroot, sudoers, NSS)
The vulnerability arises from a flaw in how `sudo` handles the `–chroot` (`-R`) option, which is intended to change the root directory of a process to isolate it from the rest of the filesystem. The `chroot` command in Linux essentially confines a process with a specific directory tree, limiting its view and access to the system.
Under normal conditions, sudo consults the sudoers file, a configuration that defines which users are allowed to execute specific commands with elevated privileges and under what conditions, including whether options like `–chroot` are permitted. However, starting with version 1.9.14 (released in June 2023), a change was introduced in how sudo handles the –chroot option. Instead of checking user permissions before changing the root directory, sudo now performs the chroot operation first. As a result, all security checks, including those based on the sudoers file, are applied inside the attacker-controlled chroot environment.
This change introduces a serious security flaw. It allows an unprivileged user to invoke sudo with a chroot target they control, even without matching sudoers rules, because the command validation and user verification occur after the chroot operation takes effect. During this phase, sudo triggers Name Service Switch (NSS) operations, causing it to load the ‘/etc/nsswitch.conf’ file from within the attacker-controlled chroot. Since this configuration file controls how the system retrieves user and group information, an attacker can craft it to include a malicious entry that points to a custom NSS module – for example, a line like ‘passwd: /woot1337’. This instructs sudo to load a shared object named like ‘libnss_woot1337.so’ from the chroot environment. When sudo loads and executes this attacker-supplied module with root privileges, it results in arbitrary code execution. For a detailed technical breakdown and Proof of Concept (PoC), see the official Stratascale advisory by Rich Mirch here.
Impact Summary
The sudo “chwoot” vulnerability enables local attackers to escalate privileges to root on affected Linux systems, bypassing standard access controls. This flaw allows attackers to fully compromise the system with minimal effort, making it critical to apply patches promptly to avoid unauthorized system takeover.
How to fix the vulnerability
CVE‑2025‑32463 has been fully addressed in sudo version 1.9.17p1, which was released on 28th June 2025. Most major Linux vendors, including Ubuntu, Debian, SUSE, Red Hat, Fedora, and Amazon Linux, have since released patches for supported distributions. Organisations running affected versions are strongly advised to apply the latest available updates without delay.
For environments where immediate patching is not possible, a temporary mitigation is available. Administrators can disable the use of the `–chroot` (`-R`) option within the sudoers policy. While this does not fully eliminate the risk, it can reduce the attack surface until a proper fix is applied. This workaround should only be considered a short-term measure.
Sentrium can assist with your vulnerability management efforts. View our penetration testing services for more details or contact us today.
