{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ocanonicalubuntu_linux24.04lts/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*","cpe:2.3:a:sudo_project:sudo:1.9.17:-:*:*:*:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:24.10:*:*:*:-:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:25.04:*:*:*:-:*:*:*","cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:*","cpe:2.3:o:opensuse:leap:15.6:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*","cpe:2.3:o:suse:linux_enterprise_desktop:15:sp6:*:*:*:*:*:*","cpe:2.3:o:suse:linux_enterprise_desktop:15:sp7:*:*:*:*:*:*","cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp2:*:*:*:*:*:*","cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp6:*:*:*:*:*:*","cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp7:*:*:*:*:*:*","cpe:2.3:o:suse:linux_enterprise_server_for_sap:12:sp6:*:*:*:*:*:*","cpe:2.3:o:suse:linux_enterprise_server_for_sap:12:sp7:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.3,"id":"CVE-2025-32463"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["sudo","glibc"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","linux","cve","vulnerability","sudo","nsswitch"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eCVE-2025-32463 describes a critical privilege escalation vulnerability affecting the \u003ccode\u003esudo\u003c/code\u003e utility when used with the \u003ccode\u003echroot\u003c/code\u003e command on Linux systems. This vulnerability allows an attacker to gain root privileges by manipulating the Name Service Switch (NSS) configuration. Specifically, a malicious actor stages a fake root filesystem (e.g., in \u003ccode\u003e/tmp/chroot\u003c/code\u003e), which includes a specially crafted \u003ccode\u003ensswitch.conf\u003c/code\u003e file and attacker-controlled NSS modules (e.g., \u003ccode\u003elibnss_*.so\u003c/code\u003e). When \u003ccode\u003esudo\u003c/code\u003e executes a command within this \u003ccode\u003echroot\u003c/code\u003e environment, it can be tricked into resolving names using the attacker's malicious NSS configuration. This forces \u003ccode\u003esudo\u003c/code\u003e to load the attacker's libraries, which then execute arbitrary code with root privileges. The technique relies on the creation of \u003ccode\u003ensswitch.conf\u003c/code\u003e in non-standard locations by shell processes, serving as an early indicator of this exploitation attempt.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker establishes initial access to a Linux system as a low-privileged user.\u003c/li\u003e\n\u003cli\u003eThe attacker creates a temporary directory structure to serve as a fake root filesystem, for example, \u003ccode\u003e/tmp/chroot\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker places a crafted \u003ccode\u003ensswitch.conf\u003c/code\u003e file within this fake root, typically at \u003ccode\u003e/tmp/chroot/etc/nsswitch.conf\u003c/code\u003e, by using a shell process.\u003c/li\u003e\n\u003cli\u003eThe attacker also places malicious Name Service Switch (NSS) modules (e.g., \u003ccode\u003elibnss_*.so\u003c/code\u003e) into appropriate library paths within the fake root, such as \u003ccode\u003e/tmp/chroot/lib\u003c/code\u003e or \u003ccode\u003e/tmp/chroot/usr/lib\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker then executes a \u003ccode\u003esudo chroot\u003c/code\u003e command, directing it to use the \u003ccode\u003echroot\u003c/code\u003e environment they've created (e.g., \u003ccode\u003esudo chroot /tmp/chroot\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eDuring the execution of \u003ccode\u003esudo chroot\u003c/code\u003e, if name resolution is triggered, \u003ccode\u003esudo\u003c/code\u003e attempts to load NSS modules from the chrooted environment, inadvertently loading the attacker's malicious modules.\u003c/li\u003e\n\u003cli\u003eThe malicious NSS module executes arbitrary code with root privileges, leading to a complete system compromise and full privilege escalation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2025-32463 results in complete privilege escalation to root on the affected Linux system. This grants the attacker full control over the compromised machine, enabling them to install backdoors, exfiltrate sensitive data, disrupt services, or launch further attacks. While specific victim numbers are not available, the widespread use of \u003ccode\u003esudo\u003c/code\u003e and \u003ccode\u003echroot\u003c/code\u003e means a broad range of Linux environments are potentially vulnerable if not patched. Organizations using \u003ccode\u003esudo\u003c/code\u003e with \u003ccode\u003echroot\u003c/code\u003e functionality are at high risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM to detect suspicious \u003ccode\u003ensswitch.conf\u003c/code\u003e file creations outside standard paths.\u003c/li\u003e\n\u003cli\u003ePatch CVE-2025-32463 immediately by updating \u003ccode\u003esudo\u003c/code\u003e and \u003ccode\u003eglibc\u003c/code\u003e to the latest versions provided by your Linux distribution vendor.\u003c/li\u003e\n\u003cli\u003eEnable comprehensive file creation and process execution logging to capture \u003ccode\u003efile.path\u003c/code\u003e, \u003ccode\u003eprocess.name\u003c/code\u003e, and \u003ccode\u003eevent.type\u003c/code\u003e to activate the rules above.\u003c/li\u003e\n\u003cli\u003eConfigure \u003ccode\u003esudoers\u003c/code\u003e to disallow \u003ccode\u003echroot\u003c/code\u003e if not explicitly required, and enforce \u003ccode\u003eenv_reset\u003c/code\u003e, \u003ccode\u003enoexec\u003c/code\u003e, and \u003ccode\u003esecure_path\u003c/code\u003e policies.\u003c/li\u003e\n\u003cli\u003eMount \u003ccode\u003e/tmp\u003c/code\u003e and \u003ccode\u003e/var/tmp\u003c/code\u003e filesystems with \u003ccode\u003enoexec\u003c/code\u003e, \u003ccode\u003enosuid\u003c/code\u003e, and \u003ccode\u003enodev\u003c/code\u003e options to prevent execution of attacker-controlled libraries or binaries from user-writable temporary directories.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T12:39:53Z","date_published":"2026-07-20T12:39:53Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2025-32463-sudo-chroot/","summary":"Attackers can exploit CVE-2025-32463, a privilege escalation vulnerability in `sudo` when used with `chroot`, by creating a malicious `nsswitch.conf` file and associated Name Service Switch (NSS) modules within a controlled chroot environment to trick `sudo` into loading attacker-controlled code, leading to root privileges on Linux systems.","title":"Sudo Chroot Privilege Escalation via NSSwitch File Manipulation (CVE-2025-32463)","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2025-32463-sudo-chroot/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*","version":"https://jsonfeed.org/version/1.1"}