Sudo Privilege Escalation Vulnerability via Chroot Option

A local privilege escalation vulnerability has been identified in the Sudo utility, specifically in versions 1.9.14 prior to 1.9.17p1. This vulnerability allows unprivileged users to gain root access by exploiting the chroot option. When Sudo is configured to use a user-controlled root directory, an attacker can manipulate the environment to load malicious shared libraries, ultimately executing arbitrary commands as root.

Impact

Exploitation of this vulnerability allows local users to escalate privileges to root, gaining full control over the system.

Reproduction

To reproduce this vulnerability, a local user must have Sudo installed and be in a Sudoers configuration that allows the chroot option. The user can then create a custom nsswitch.conf file in a writable directory, specifying a malicious library that, when loaded by Sudo, executes a payload with root privileges.

Remediation

Users are advised to update Sudo to version 1.9.17p1 or later, where this vulnerability has been fixed.