CVE-2025-46717

Executive Summary

CVE-2025-46717 is a low-severity information disclosure vulnerability in sudo-rs, a memory-safe implementation of sudo and su written in Rust. The flaw allows local users with minimal or no sudo privileges to determine the existence of files in directories they would otherwise be unable to access. This is achieved by using the sudo --list <pathname> command, which reveals whether a file exists based on the command's output or error behavior. While the vulnerability does not allow file content access, it can be used to map file systems and gather intelligence for further attacks. The issue is fixed in version 0.2.6.

Supply Chain & Package Security

sudo-rs is a Rust-based reimplementation of the classic sudo utility, distributed as a binary package or via source. The vulnerability exists in the --list command's path resolution logic. Since sudo-rs is a system-level tool, the supply chain risk is moderate; however, the fix is straightforward and should be applied promptly.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs local access and a low-privileged account
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – only file existence is leaked
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Low. The vulnerability requires local access and only reveals file existence, not content. However, it can be chained with other attacks to escalate privileges or gather sensitive information.

Deep Dive & Mechanics

The vulnerability resides in the --list (or -l) command of sudo-rs. When a user runs sudo --list <pathname>, the tool checks if the user has permission to list the specified file or directory. Due to improper error handling, the tool returns different responses based on whether the file exists, even if the user lacks read permissions on the parent directory.

Root Cause: The --list command does not properly mask the existence of files when the user lacks directory traversal permissions. Instead of returning a generic "permission denied" error, it reveals whether the path exists by returning a specific error or success message.

Attack Scenario:

1. Attacker gains local access to a system with sudo-rs installed (version < 0.2.6).
2. Attacker runs sudo --list /etc/shadow – if the file exists, the command may return a "not allowed" message; if it does not exist, it returns a "file not found" error.
3. By iterating over potential file paths, the attacker can map the file system and discover sensitive files (e.g., configuration files, SSH keys, audit logs).

Impact: Information disclosure of file existence, which can be used to:

• Identify sensitive files for targeted attacks.
• Confirm the presence of security tools or configurations.
• Aid in privilege escalation or lateral movement.

Vulnerable vs. Patched Code

Vulnerable Code (sudo-rs < 0.2.6):

// Simplified vulnerable logic
fn list_path(path: &str) -> Result<(), Error> {
    if user_has_permission(path) {
        // Check if path exists
        if Path::new(path).exists() {
            // Return success or list contents
            Ok(())
        } else {
            Err(Error::FileNotFound)
        }
    } else {
        Err(Error::PermissionDenied)
    }
}

Patched Code (sudo-rs >= 0.2.6):

// Patched logic – always return PermissionDenied if user lacks access
fn list_path(path: &str) -> Result<(), Error> {
    if user_has_permission(path) {
        // Only check existence if user has permission
        if Path::new(path).exists() {
            Ok(())
        } else {
            Err(Error::FileNotFound)
        }
    } else {
        // Do not reveal existence – always return PermissionDenied
        Err(Error::PermissionDenied)
    }
}

The fix ensures that when a user lacks permission to access a directory, the --list command always returns a generic "permission denied" error, regardless of whether the file exists.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• Install sudo-rs version 0.2.5 on a Linux VM.
• Create a low-privileged user account.
• Place a sensitive file (e.g., /root/secret.txt) on the system.

Exploitation Steps:

1. Log in as the low-privileged user.
2. Run the following command to test file existence:

   sudo --list /root/secret.txt
   

   • If the file exists, the output may be: Sorry, user <username> is not allowed to execute '/root/secret.txt' as root on <hostname>.
   • If the file does not exist, the output may be: sudo: unable to stat /root/secret.txt: No such file or directory
3. Use a script to enumerate files:

   for file in /root/secret.txt /root/backup.tar.gz /etc/shadow; do
       sudo --list "$file" 2>&1 | grep -q "unable to stat" && echo "$file: NOT FOUND" || echo "$file: EXISTS"
   done
   

Expected Output:

/root/secret.txt: EXISTS
/root/backup.tar.gz: NOT FOUND
/etc/shadow: EXISTS

Blue Team (Detection & Response)

Detection:

• Monitor for repeated sudo --list commands targeting sensitive directories (e.g., /root, /etc, /var/log).
• Look for anomalous patterns in sudo logs (e.g., /var/log/auth.log or journalctl).

Response:

• Immediately upgrade sudo-rs to version 0.2.6 or later.
• Review sudo logs for suspicious --list usage.
• If exploitation is detected, investigate the attacker's access and consider rotating sensitive files.

Indicators of Compromise (IOCs)

• Log Entries: Repeated sudo --list commands in /var/log/auth.log or journalctl for paths like /root/*, /etc/shadow, /var/log/secure.
• Process Names: sudo with --list or -l flag.
• File System Artifacts: Scripts or binaries that enumerate file existence using sudo --list.
• Network IOCs: None (local vulnerability).

Detection Engineering

YARA Rule

rule sudo_rs_cve_2025_46717 {
    meta:
        description = "Detects exploitation attempts of CVE-2025-46717 via sudo --list commands"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46717"
    strings:
        $s1 = "sudo --list" ascii wide nocase
        $s2 = "sudo -l" ascii wide nocase
        $s3 = "/root/" ascii wide nocase
        $s4 = "/etc/shadow" ascii wide nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: Suspicious sudo --list Usage for File Existence Enumeration
id: 8a7b3c2d-1e5f-4a6b-9c8d-7e2f1a3b4c5d
status: experimental
description: Detects repeated sudo --list commands targeting sensitive directories, indicative of CVE-2025-46717 exploitation.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-46717
logsource:
    product: linux
    service: auth
detection:
    selection:
        EventID: 1  # Process creation (Sysmon)
        CommandLine|contains|all:
            - 'sudo'
            - '--list'
        CommandLine|contains:
            - '/root/'
            - '/etc/shadow'
            - '/var/log/'
    condition: selection
falsepositives:
    - Legitimate administrative use of sudo --list
level: medium
tags:
    - attack.t1083
    - cve.2025.46717

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-46717 sudo-rs File Existence Enumeration"; flow:to_server; content:"sudo --list"; nocase; content:"/root/"; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Fix:

• Upgrade sudo-rs to version 0.2.6 or later.

  # For systems using cargo
  cargo install sudo-rs --version 0.2.6
  # Or via package manager (if available)
  sudo apt update && sudo apt install sudo-rs=0.2.6
  

Mitigation (if patching is delayed):

• Restrict local access to trusted users only.
• Monitor sudo logs for anomalous --list usage.
• Use file system permissions to limit exposure of sensitive files.

Long-term:

• Implement least privilege principles for all users.
• Regularly audit sudo configurations and logs.

Valters IT