Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability

概要

参考情報

• access.redhat.com/security/cve/cve-2025-32463 · Third Party Advisory
• bugs.gentoo.org/show_bug.cgi · Issue Tracking
• explore.alas.aws.amazon.com/CVE-2025-32463.html · Third Party Advisory
• security-tracker.debian.org/tracker/CVE-2025-32463 · Third Party Advisory
• ubuntu.com/security/notices/USN-7604-1 · Third Party Advisory
• openwall.com/lists/oss-security/2025/06/30/3 · Third Party Advisory
• secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463 · Exploit
• stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot · Exploit
• sudo.ws/releases/changelog · Release Notes
• sudo.ws/security/advisories · Vendor Advisory
• sudo.ws/security/advisories/chroot_bug

sudo のその他の脆弱性

• CVE-2026-35535高 7.8In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer…
• CVE-2025-32462高 8.8Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to e…
• CVE-2023-7090高 8.8A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore,…
• CVE-2023-42465高 7.0Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is…
• CVE-2023-28487中 5.3Sudo before 1.9.13 does not escape control characters in sudoreplay output.