# Local Privilege Escalation via chroot option

**URL:** https://discuss.privacyguides.net/t/local-privilege-escalation-via-chroot-option/28857
**Category:** General
**Tags:** software, article
**Created:** 2025-07-03T19:15:18Z
**Posts:** 10

## Post 1 by @asanyan — 2025-07-03T19:15:18Z

> **[Local Privilege Escalation via chroot option](https://www.sudo.ws/security/advisories/chroot_bug/)**
>
> An attacker can leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.
> Sudo versions affected: Sudo versions 1.9.14 to 1.9.17 inclusive are affected.
> CVE ID: This vulnerability has...

Update, and if possible don’t use sudo.

---

## Post 2 by @CarefulMouse — 2025-07-03T19:17:31Z

> [@asanyan](#):
>
> [Local Privilege Escalation via chroot option | Sudo](https://www.sudo.ws/security/advisories/chroot_bug/)

What common distros ship with this version of sudo?

> ## Sudo versions affected:
> 
> Sudo versions 1.9.14 to 1.9.17 inclusive are affected.

---

## Post 3 by @anon63378630 — 2025-07-03T19:23:56Z

> [@CarefulMouse](#):
>
> What common distros ship with this version of sudo?

[External Image](https://repology.org/badge/vertical-allrepos/sudo.svg "Image hosted on another site. Click to open in a new tab.")

---

## Post 4 by @anon39279085 — 2025-07-03T19:52:42Z

well I guess it’s roundabout time, logging into root and updating

---

## Post 5 by @micdan — 2025-07-04T16:31:36Z

> A critical Linux vulnerability (CVE-2025-32463) in Sudo lets any local unprivileged user gain root via the --chroot (-R) option

> :locked: Affects default configs on Ubuntu, Fedora & others — no Sudo rules needed  
> :hammer_and_wrench: Fix: Update to Sudo 1.9.17p1+ (no workarounds)  
> :eyes: CVSS: 9.8 (Critical)  
> [[1]](#footnote-100318-1)

> **[Linux Sudo chroot Vulnerability Enables Hackers to Elevate Privileges to Root](https://cybersecuritynews.com/linux-sudo-chroot-vulnerability/)**
>
> A security vulnerability in the widely used Linux Sudo utility has been disclosed, allowing any local unprivileged user to escalate privileges. 

* * *

1. [knoppix: "A critical Linux vulnerability (CVE-2025-32463) i…" - Mastodon](https://mastodon.social/@knoppix95/114795689934740075) [↩︎](#footnote-ref-100318-1)

---

## Post 6 by @anon63378630 — 2025-07-04T17:00:15Z

related: fedora is currently in the middle of a datacenter move and so package updates are currently in freeze: [https://www.fedorastatus.org/](https://www.fedorastatus.org/)  
it should hopefully complete soon and updates resume

---

## Post 7 by @Cyber-Typhoon — 2025-07-04T17:30:55Z

Wouldn’t someone using [Run0](https://www.freedesktop.org/software/systemd/man/257/run0.html) prevent an attacker to gain root access in this case?

Also, I believe that if you have [AIDE](https://wiki.archlinux.org/title/AIDE) and [chkrootkit](https://wiki.archlinux.org/title/Rkhunter) it could detect the aftermath and if not too late take some action.

---

## Post 8 by @Cyber-Typhoon — 2025-07-10T18:42:04Z

Re-warming the discussion in light of a new find:

> **[How Was This Even Possible?](https://www.youtube.com/watch?v=9nRr3R9gEb8)**
>
> They found another bug in sudo, and this time it's pretty bad.https://nvd.nist.gov/vuln/detail/CVE-2025-32462https://github.com/pr0v3rbs/CVE-2025-32463_chwoo...

Is it time to pay closer attention to the security model around sudo?

---

## Post 9 by @anon92357554 — 2025-07-11T03:38:11Z

I was planning on switching to run0 just because, but the added friction of having to type it in every time, and the prompt popping up outside the terminal just felt too foreign for me. Will revisit it when they fix both of those UI/UX issues.

---

## Post 10 by @seize — 2025-07-11T04:11:29Z

This may be a bit off topic, so moderators feel free to (re)move this post if needed.

I don’t have a fix for the popup prompt. However you can reduce some friction by aliasing sudo to run0 in your “~/.bashrc” like so:

```
alias sudo="run0"
```

then reload your .bashrc

```
source ~/.bashrc
```

Now anytime you type sudo you are really running “run0”.