CVE-2025-64517: sudo-rs Improper User Authentication Timestamp Recording Vulnerability
Summary
CVE-2025-64517: sudo-rs doesn't record authenticating user properly in timestamp. Affects sudo-rs versions >= 0.2.5, < 0.2.10. Fixed in 0.2.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sudo-rs is a Rust implementation of the sudo command, which allows users to run programs with the security privileges of another user, typically the superuser. It is designed to provide a secure way to grant elevated privileges to users while maintaining a log of their actions. The package offers features such as user authentication, command logging, and fine-grained access control. However, a vulnerability exists in versions prior to 0.2.10 that affects how user authentication timestamps are recorded, potentially allowing privilege escalation.
Vulnerability Detail
The vulnerability arises when the 'Defaults targetpw' or 'Defaults rootpw' options are enabled. In these cases, sudo-rs incorrectly records the UID of the invoking user instead of the UID of the user being authenticated. This flaw allows a highly-privileged user to bypass new authentication requirements, enabling them to execute commands as any other permitted user without knowing their passwords. This can lead to unauthorized access and privilege escalation, undermining the security model intended by the sudo mechanism.
How To Fix
Minimum fixed version
0.2.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the 'Defaults targetpw' or 'Defaults rootpw' options in your /etc/sudoers file to prevent this vulnerability from being exploited. However, this may alter the intended behavior of user authentication. Example configuration change:
Comment out the following lines in /etc/sudoers
Defaults targetpw
Defaults rootpw
Conclusion
The sudo-rs vulnerability CVE-2025-64517 poses a significant risk by allowing unauthorized command execution through improper user authentication timestamp recording. It is crucial to update to version 0.2.10 or later to mitigate this risk effectively. Users should also consider temporary workarounds if immediate updates are not feasible.
See every vulnerability recorded for sudo-rs →
FAQ
The impact includes the potential for unauthorized users to execute commands as other users or as root without knowing their passwords, leading to privilege escalation.
Versions of sudo-rs prior to 0.2.10 are affected by this vulnerability. Versions 0.2.5 and earlier are not impacted as they do not support the relevant options.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your Cargo.lock file, you can check if your application is affected by this vulnerability.
If an immediate update is not possible, consider disabling the 'Defaults targetpw' or 'Defaults rootpw' options as a temporary workaround to mitigate the risk.
The CVSS score of this vulnerability is 4.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for sudo-rs.
