CVE-2025-46718

Executive Summary

CVE-2025-46718 is a low-severity information disclosure vulnerability in sudo-rs, a memory-safe implementation of sudo and su written in Rust. The flaw allows users with limited sudo privileges (e.g., permission to execute only a single command) to enumerate the sudo privileges of other users by using the -U flag. This enables an attacker to map out the sudoers file, revealing sensitive permission data that can be used to plan more targeted attacks. The vulnerability is patched in version 0.2.6. Systems where users have no sudo privileges or have full root access via sudo (default configuration) are not affected.

Supply Chain & Package Security

This vulnerability affects the sudo-rs package, which is a Rust-based reimplementation of the classic sudo utility. It is distributed via package registries and source repositories. Organizations using sudo-rs in their infrastructure should verify their version and apply the patch immediately to prevent local privilege enumeration.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: Low (PR:L) – attacker must have limited sudo privileges.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability does not cross trust boundaries.
• Confidentiality Impact: Low (C:L) – limited information disclosure (sudoers file).
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Low. The vulnerability requires local access and limited sudo privileges, but it can be used to gather intelligence for privilege escalation attacks.

Deep Dive & Mechanics

The vulnerability resides in the -U (list other user's privileges) flag implementation in sudo-rs. In standard sudo, the -U flag allows a user to list the sudo privileges of another user, but this operation is typically restricted to users with full sudo privileges (e.g., ALL). In sudo-rs versions prior to 0.2.6, the access control check for the -U flag was insufficient. A user with limited sudo privileges (e.g., allowed to run only /usr/bin/whoami as root) could still use sudo -U otheruser -l to list the privileges of any other user.

The root cause is a missing or incorrect privilege check in the code that handles the -U flag. Instead of verifying that the requesting user has the right to list other users' privileges (which should require ALL or specific sudoers rules), the code only checked if the user had any sudo privileges at all. This allowed users with minimal permissions to enumerate the entire sudoers file.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 0.2.6):

// Simplified vulnerable logic
fn list_user_privileges(requesting_user: &User, target_user: &User) -> Result<(), Error> {
    // Only checks if requesting user has any sudo privileges
    if !requesting_user.has_sudo_privileges() {
        return Err(Error::AccessDenied);
    }
    // Lists privileges of target_user without further checks
    let privileges = get_sudoers_privileges(target_user)?;
    println!("{}", privileges);
    Ok(())
}

Patched Code (version 0.2.6):

// Simplified patched logic
fn list_user_privileges(requesting_user: &User, target_user: &User) -> Result<(), Error> {
    // Checks if requesting user has full sudo privileges (e.g., ALL)
    if !requesting_user.has_full_sudo_privileges() {
        return Err(Error::AccessDenied);
    }
    // Only then lists privileges of target_user
    let privileges = get_sudoers_privileges(target_user)?;
    println!("{}", privileges);
    Ok(())
}

The patch adds a check for has_full_sudo_privileges() instead of just has_sudo_privileges(), ensuring that only users with unrestricted sudo access (e.g., ALL) can list other users' privileges.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a system running sudo-rs < 0.2.6.
• A user account with limited sudo privileges (e.g., can run only one command as root).

Exploitation Steps:

1. Log in as the limited user (e.g., limiteduser).
2. Verify limited sudo privileges:

   sudo -l
   

   Output should show a single allowed command, e.g., /usr/bin/whoami.
3. Enumerate privileges of another user (e.g., adminuser):

   sudo -U adminuser -l
   

4. If successful, the output will show the sudo privileges of adminuser, potentially revealing that adminuser has full root access.
5. Repeat for all users to map the sudoers file.

Expected Output:

User adminuser may run the following commands on this host:
    (ALL) ALL

Blue Team

Detection:

• Monitor for unusual use of sudo -U by users who do not have full sudo privileges.
• Look for patterns where a user with limited sudo privileges (e.g., only one command) suddenly queries other users' privileges.

Hunting:

• Search audit logs for sudo -U commands executed by non-root users.
• Correlate with sudoers file changes or privilege escalation attempts.

Prevention:

• Apply the patch to sudo-rs version 0.2.6.
• Restrict sudo privileges to only those who need them.
• Use monitoring tools to alert on sudo -U usage by unauthorized users.

Indicators of Compromise (IOCs)

• Command: sudo -U <username> -l executed by a user with limited sudo privileges.
• Log Entry: In /var/log/auth.log or similar, look for entries like:

  sudo: limiteduser : TTY=pts/0 ; PWD=/home/limiteduser ; USER=root ; COMMAND=/usr/bin/sudo -U adminuser -l
  

• Process: sudo process with arguments -U and -l from a non-privileged user.

Detection Engineering

YARA Rule

rule sudo_rs_info_disclosure {
    meta:
        description = "Detects sudo-rs CVE-2025-46718 exploitation attempts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46718"
    strings:
        $s1 = "sudo -U" ascii wide nocase
        $s2 = "-l" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Sudo-rs Privilege Enumeration via -U Flag
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects use of sudo -U by users with limited sudo privileges (CVE-2025-46718)
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/sudo'
        CommandLine|contains|all:
            - '-U'
            - '-l'
    filter:
        User|endswith: 'root'
    condition: selection and not filter
falsepositives:
    - Legitimate use by administrators with full sudo privileges
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-46718 Sudo-rs Privilege Enumeration Attempt"; flow:to_server,established; content:"sudo -U"; nocase; content:"-l"; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade sudo-rs to version 0.2.6 or later.
• If upgrade is not possible, restrict sudo access to only trusted users.

Long-term:

• Implement the principle of least privilege for sudo access.
• Regularly audit sudoers file and user permissions.
• Monitor for unusual sudo usage patterns.

Workaround:

• Remove the -U flag functionality by modifying the sudoers file or using a wrapper script that blocks the -U flag for non-admin users.

Patch Details:

• Upgrade to sudo-rs version 0.2.6 from the official repository.

Valters IT
Securing Digital Frontiers