CVE-2025-64170

Executive Summary

CVE-2025-64170 is a low-severity information disclosure vulnerability in the sudo-rs package, a memory-safe Rust implementation of sudo and su. The flaw affects versions 0.2.7 through 0.2.9. When a user begins typing a password but does not press Enter before a configured password timeout occurs, the keystrokes that were entered are echoed back to the console. This can expose partial password characters on screen, making them visible to nearby observers (shoulder surfing) or potentially captured in terminal history files. The issue is fixed in version 0.2.10.

Supply Chain & Package Security

This vulnerability affects the sudo-rs package, which is distributed via crates.io (Rust package registry). Organizations using Rust-based systems or containers that include sudo-rs should verify their dependency version and update to 0.2.10 or later. Since sudo-rs is a core system utility, supply chain risk is elevated; a compromised or vulnerable version could affect all users on a system.

CVSS Breakdown & Threat Level

• CVSS Score: 3.8 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Local (AV:L) – requires physical or terminal access.
• Attack Complexity: Low (AC:L) – no special conditions.
• Privileges Required: Low (PR:L) – attacker needs a user account.
• User Interaction: None (UI:N) – no user action beyond normal password entry.
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – partial password disclosure.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Low. Exploitation requires local access and a specific timing condition. The EPSS score is 0.0%, indicating no active exploitation in the wild.

Deep Dive & Mechanics

The vulnerability resides in the password input handling logic of sudo-rs. When a user starts typing a password, the terminal is typically set to no-echo mode to prevent keystrokes from being displayed. However, if a password timeout occurs (e.g., the user pauses for too long), the code incorrectly resets the terminal echo state before the password entry is complete. As a result, any characters typed after the timeout are echoed to the console.

The root cause is a race condition or improper state management in the password timeout routine. The fix in version 0.2.10 ensures that the terminal echo remains disabled until the password entry is fully completed or explicitly cancelled.

Vulnerable vs. Patched Code

Vulnerable (0.2.7 - 0.2.9):

// Simplified vulnerable logic
fn read_password() -> String {
    let mut password = String::new();
    set_echo(false);
    loop {
        let c = read_char();
        if timeout_occurred() {
            // BUG: Echo is re-enabled here prematurely
            set_echo(true);
            break;
        }
        password.push(c);
    }
    // Echo remains on after timeout
    password
}

Patched (0.2.10):

// Corrected logic
fn read_password() -> String {
    let mut password = String::new();
    set_echo(false);
    loop {
        let c = read_char();
        if timeout_occurred() {
            // Echo remains off until password is fully processed
            break;
        }
        password.push(c);
    }
    // Echo is restored only after password entry is complete
    set_echo(true);
    password
}

Exploitation & Lab Setup

Red Team (Adversarial Simulation)

1. Setup: Install sudo-rs version 0.2.9 on a test Linux system.
2. Trigger: As a low-privileged user, run sudo -k to clear cached credentials, then run sudo ls. When prompted for a password, type a few characters (e.g., "abc") and wait for the password timeout (default ~5 minutes).
3. Observation: After the timeout, the characters "abc" will be echoed to the terminal, revealing partial password input.
4. Impact: An attacker with physical or remote terminal access can observe the echoed characters, potentially capturing password fragments.

Blue Team (Defensive Detection)

1. Monitor for unusual terminal echo behavior: Look for processes that unexpectedly change terminal echo settings.
2. Audit sudo-rs version: Check installed version with sudo-rs --version. If < 0.2.10, flag for update.
3. User awareness: Train users to press Enter immediately after typing a password to avoid timeout exposure.

Indicators of Compromise (IOCs)

• File: /usr/bin/sudo-rs with version string 0.2.7, 0.2.8, or 0.2.9.
• Behavior: Terminal echo state changes during password prompts (detectable via stty -a or kernel audit).
• Log: No specific log entries; detection relies on behavioral monitoring.

Detection Engineering

YARA Rule

rule sudo_rs_password_echo_vuln {
    meta:
        description = "Detects vulnerable sudo-rs binary versions (0.2.7 - 0.2.9)"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-64170"
    strings:
        $vuln_str = "sudo-rs 0.2." ascii wide
        $vuln_ver1 = "0.2.7" ascii wide
        $vuln_ver2 = "0.2.8" ascii wide
        $vuln_ver3 = "0.2.9" ascii wide
    condition:
        $vuln_str and ($vuln_ver1 or $vuln_ver2 or $vuln_ver3)
}

Sigma Rule

title: Sudo-rs Password Echo Vulnerability
id: 8a4b2c1d-3e5f-4a7b-9c8d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2025-64170 where password keystrokes are echoed after timeout
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/sudo-rs'
        CommandLine|contains: 'sudo'
    condition: selection
falsepositives:
    - Legitimate sudo usage
level: low

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-64170 Sudo-rs Password Echo Attempt"; flow:to_server; content:"sudo"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade sudo-rs to version 0.2.10 or later.

   cargo install sudo-rs --version 0.2.10
   

2. Workaround: Reduce password timeout to a very low value (e.g., 1 second) in /etc/sudo-rs.conf:

   password_timeout = 1
   

3. User training: Advise users to press Enter immediately after typing a password to avoid timeout exposure.
4. Monitoring: Implement the YARA/Sigma rules above to detect vulnerable binaries.

Valters IT