chwoot: he sudo flaw that turns local Linux users into root – in seconds

A newly discovered vulnerability in the widely used Linux tool sudo is currently exposing millions of systems to a critical security threat. The flaw lies in the chroot function of sudo, which is intended to isolate users within restricted directories. Instead, under certain conditions, it allows local users to break out and gain full root privileges.

This vulnerability has been dubbed “chwoot” — a blend of chroot and root — and it has already been assigned a CVE identifier: CVE-2025-32463, with a CVSS score of 9.2 (critical). A working proof-of-concept (PoC) exploit is publicly available, making immediate action essential. G.Business reports, citing a technical analysis by heise online.

What is “chwoot” and how does it work

The chwoot vulnerability leverages a logic flaw in how sudo handles chroot operations combined with dynamic linking through the Name Service Switch (NSS).

Here’s what happens:

• Sudo, when configured to use chroot, temporarily switches a user into a contained directory.
• During that process, sudo indirectly loads /etc/nsswitch.conf via the NSS system.
• If an attacker plants a malicious .so (shared object) file, NSS will dynamically load and execute it as root.
• This allows code execution with full administrative privileges, even if the user was previously unprivileged.

This vulnerability requires no kernel exploits, no buffer overflows, and no root password — just smart abuse of expected system behavior.

Why is this dangerous

This isn’t a vulnerability buried deep in a rarely used library. Sudo is used everywhere. Developers, sysadmins, testers, even users in Docker containers regularly run sudo.

The risk is compounded because:

• The attack can be executed locally in under 60 seconds.
• Shared environments, like universities, CI/CD runners, and hosting providers, are especially at risk.
• Cloud providers often use outdated base images that include vulnerable versions of sudo.
• The exploit is public, making opportunistic attacks likely.

Affected systems and vulnerable versions

How to protect your systems: step-by-step guidance

1. Identify affected hosts

bashKopierenBearbeitensudo --version

If the version is between 1.8.32 and 1.9.17, the system is vulnerable. Check every production server, dev machine, container host, and cloud image.

2. Apply updates immediately
Use your package manager to update sudo:

• Ubuntu/Debian:

bashKopierenBearbeitensudo apt update && sudo apt install sudo

• Fedora:

bashKopierenBearbeitensudo dnf upgrade sudo

• Arch Linux:

bashKopierenBearbeitensudo pacman -Syu sudo

3. Harden NSS behavior
Where possible, restrict NSS module loading to trusted libraries. Validate permissions and ownership of all files under /etc/nsswitch.conf and /lib.

4. Patch cloud base images and rebuild templates
Simply updating a live system isn't enough. If you're deploying from prebuilt images (e.g., in AWS, Hetzner, or Azure), rebuild those images with patched sudo versions. Otherwise, you’ll keep deploying vulnerable machines.

5. Monitor for suspicious activity
Enable detailed sudo logging:

bashKopierenBearbeitenDefaults log_output, logfile="/var/log/sudo.log"

Set up alerts for:

• Unexpected use of chroot
• Sudden root access by non-admin accounts
• Execution of unknown shared objects (.so files)

6. Educate your teams

• Developers and SREs should avoid relying on untrusted or outdated images.
• Automated build pipelines should validate package versions before rollout.
• Security teams should share internal advisories and mitigation status.

A second vulnerability: CVE-2025-32462

Security researcher Rich Mirch also discovered a second issue: sudoers host-based restrictions in /etc/sudoers can be bypassed by chaining command-line arguments.

• CVE: 2025-32462
• Risk level: Low (CVSS 2.8), but notable in restricted environments
• Fixed in: sudo 1.9.17p1
• Existed for: over 12 years unnoticed

Even if it’s less severe, organizations should patch it alongside chwoot to avoid targeted privilege escalation attacks.

Security recap: what to do right now

When Root Is One Command Away: Why chwoot Demands Immediate Action

When any local user can escalate to root without a password, this isn’t just “another vulnerability.” It’s a complete failure of foundational security controls. It breaks the assumptions of user isolation, permission separation, and administrative control — assumptions on which every production environment relies.

Whether you’re running

• Cloud infrastructure on AWS, Azure, Hetzner, etc.
• Bare-metal clusters in private datacenters
• CI/CD pipelines with shared runners
• Developer VMs and containerized build systems

…the chwoot vulnerability introduces a silent, local, privilege escalation vector that’s trivial to execute and hard to detect.

What makes chwoot so dangerous is not complexity — but simplicity. One shared object. One user. One sudo call. Full root. This is not about chasing zero-days. This is a wake-up call about basic operational hygiene — in the tools we rely on most.

What You Should Do Immediately

1. Audit every host for sudo versions
   • Flag any host running sudo 1.8.32–1.9.17
2. Patch every system
   • Upgrade to sudo 1.9.17p1 or newer using your distribution’s package manager
3. Rebuild and verify base images
   • Don’t just patch live systems
   • Rebuild cloud templates, Docker images, CI workers
4. Enforce secure NSS configurations
   • Lock down /etc/nsswitch.conf
   • Ensure shared libraries can’t be injected via writable paths
5. Log and monitor sudo behavior
   • Enable verbose logging in /etc/sudoers
   • Stream logs into your SIEM or intrusion detection
6. Communicate risk across teams
   • Let SREs, platform engineers, and developers know the implications
   • Review access policies and sandboxing assumptions

Every hour an affected system remains unpatched is an opportunity for silent escalation.

Patch. Harden. Monitor. Repeat.

Because trust in your infrastructure should be earned — and protected — one layer at a time.

Stay connected for news that works — timely, factual, and free from opinion. Learn more about this topic and related developments here: Nothing Phone 3: How Light and Silence Are Disrupting the Smartphone Industry