Critical Local Privilege Escalation Vulnerability in sudo Package
Summary
RLSA-2025:11537: Important: sudo security update. Affects sudo versions < 0:1.9.15-8.p5.el10_0.2. Fixed in 0:1.9.15-8.p5.el10_0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sudo package is a widely used utility that allows system administrators to grant specific users the ability to execute commands with elevated privileges, without needing to log in as the root user. This functionality is crucial for system management and security, as it enables controlled access to sensitive commands. However, vulnerabilities in sudo can pose significant risks, as they may allow unauthorized users to gain elevated privileges, potentially compromising the entire system.
Vulnerability Detail
The sudo package has been identified with two critical local privilege escalation vulnerabilities: CVE-2025-32462 and CVE-2025-32463. These vulnerabilities arise from improper handling of host and chroot options, which can be exploited by an attacker with limited privileges to escalate their access to root privileges. The ramifications of these vulnerabilities are severe, as they can lead to complete system compromise, allowing attackers to execute arbitrary commands with full administrative rights.
How To Fix
Minimum fixed version
0:1.9.15-8.p5.el10_0.2
This is the first release that contains the fix.
sudo dnf update sudoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, system administrators can limit the use of sudo for affected users or disable specific functionalities until the package is updated. However, this is not a permanent solution and should only be used until the patch is applied.
Conclusion
The sudo package is critical for managing user permissions and executing commands with elevated privileges. However, the identified vulnerabilities pose significant risks that can lead to unauthorized access and system compromise. It is crucial to update the package to the latest version to mitigate these risks effectively.
See every vulnerability recorded for sudo →
FAQ
The vulnerabilities are identified as CVE-2025-32462 and CVE-2025-32463.
The CVSS score for this vulnerability is 7.8, indicating a high level of severity.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can receive real-time alerts. You can also check your application using the Vulert playground without any signup.
If immediate updates are not possible, consider limiting sudo access for affected users and disabling specific functionalities as a temporary workaround.
For more details, refer to the CVE pages associated with CVE-2025-32462 and CVE-2025-32463.
Related vulnerabilities
Recent vulnerabilities recorded for sudo.
