Bug 2374692 (CVE-2025-32462)

Summary: CVE-2025-32462 sudo: LPE via host option
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: VERIFIED --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: bwelterl, crizzo, jmitchel, jtanner, kshier, ktordeur, pawel.b, prodsec-dev, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---Flags: ktordeur: needinfo? (prodsec-dev)
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A privilege escalation vulnerability was found in Sudo. In certain configurations, unauthorized users can gain elevated system privileges via the Sudo host option (`-h` or `--host`). When using the default sudo security policy plugin (sudoers), the host option is intended to be used in conjunction with the list option (`-l` or `--list`) to determine what permissions a user has on a different system. However, this restriction can be bypassed, allowing a user to elevate their privileges on one system to the privileges they may have on a different system, effectively ignoring the host identifier in any sudoers rules. This vulnerability is particularly impactful for systems that share a single sudoers configuration file across multiple computers or use network-based user directories, such as LDAP, to provide sudoers rules on a system.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2375841, 2375842    
Bug Blocks:    
Deadline: 2025-06-30   

Description OSIDB Bzimport 2025-06-24 21:23:48 UTC
Sudo's host (`-h` or `--host`) option is intended to be used in conjunction with the list option (`-l` or `--list`) to list a user's sudo privileges on a host other than the current one.  However, due to a bug it was not restricted to listing privileges and could be used when running a command via `sudo` or editing a file with
`sudoedit`.  Depending on the rules present in the sudoers file this could allow a local privilege escalation attack.

Comment 2 errata-xmlrpc 2025-06-30 19:39:19 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:9978 https://access.redhat.com/errata/RHSA-2025:9978

Comment 3 errata-xmlrpc 2025-07-01 19:44:55 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:10110 https://access.redhat.com/errata/RHSA-2025:10110

Comment 6 Pawel B. 2025-07-04 14:26:41 UTC
Dear Team,

Related to "Sudo's host (`-h` or `--host`)"
While fixing this vulnerability, could you please also correct help information?
  -h, --help                    display help message and exit
  -h, --host=host               run command on host (if supported by plugin)

Second "-h" should be written with capital letter.

Kind regards
P.

Comment 7 errata-xmlrpc 2025-07-07 08:58:16 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support EXTENSION
  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

Via RHSA-2025:10383 https://access.redhat.com/errata/RHSA-2025:10383

Comment 8 errata-xmlrpc 2025-07-07 17:08:34 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2025:10518 https://access.redhat.com/errata/RHSA-2025:10518

Comment 9 errata-xmlrpc 2025-07-07 18:12:57 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:10520 https://access.redhat.com/errata/RHSA-2025:10520

Comment 11 errata-xmlrpc 2025-07-09 12:58:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:10707 https://access.redhat.com/errata/RHSA-2025:10707

Comment 12 errata-xmlrpc 2025-07-10 08:39:42 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:10779 https://access.redhat.com/errata/RHSA-2025:10779

Comment 13 errata-xmlrpc 2025-07-14 01:11:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:10835 https://access.redhat.com/errata/RHSA-2025:10835

Comment 14 errata-xmlrpc 2025-07-14 01:16:08 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:10836 https://access.redhat.com/errata/RHSA-2025:10836

Comment 15 errata-xmlrpc 2025-07-14 10:38:06 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2025:10871 https://access.redhat.com/errata/RHSA-2025:10871

Comment 17 errata-xmlrpc 2025-07-17 21:32:35 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.18

Via RHSA-2025:10767 https://access.redhat.com/errata/RHSA-2025:10767

Comment 18 errata-xmlrpc 2025-07-17 21:33:23 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.16

Via RHSA-2025:10781 https://access.redhat.com/errata/RHSA-2025:10781

Comment 19 errata-xmlrpc 2025-07-22 14:22:41 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:11537 https://access.redhat.com/errata/RHSA-2025:11537

Comment 22 errata-xmlrpc 2025-08-07 00:33:58 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.15

Via RHSA-2025:12370 https://access.redhat.com/errata/RHSA-2025:12370

Comment 23 errata-xmlrpc 2025-08-07 01:16:50 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.17

Via RHSA-2025:12437 https://access.redhat.com/errata/RHSA-2025:12437

Comment 24 errata-xmlrpc 2025-08-07 18:02:40 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2025:12323 https://access.redhat.com/errata/RHSA-2025:12323

Comment 25 errata-xmlrpc 2025-08-14 04:08:17 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2025:13289 https://access.redhat.com/errata/RHSA-2025:13289

Comment 26 errata-xmlrpc 2025-08-26 13:32:12 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.19

Via RHSA-2025:10771 https://access.redhat.com/errata/RHSA-2025:10771

Comment 28 errata-xmlrpc 2025-09-18 05:45:06 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2025:15672 https://access.redhat.com/errata/RHSA-2025:15672