Sudo chroot Local Privilege Escalation on Linux (CVE-2025-32463)

CVE-2025-32463 is a local privilege escalation in sudo related to the -R / chroot option. A user with permission to run specific sudo commands may escape restrictions and execute code as root on misconfigured or vulnerable builds.

Affected versions

• Sudo before 1.9.17p1 (check vendor backports for your distro)
• Systems granting sudo rules with chroot or namespace options

Audit commands

sudo --version | head -1
sudo -l
rpm -q sudo 2>/dev/null || dpkg -l sudo
grep -R 'CHROOT' /etc/sudoers /etc/sudoers.d/ 2>/dev/null

Fix

• Upgrade sudo package from OS vendor security channel
• Remove unnecessary sudo -R / chroot allowances from sudoers
• Limit sudo to explicit command lists per user
• Monitor /var/log/auth.log for sudo failures followed by root shells

Type: Local only, but high impact on shared admin hosts and jump boxes.