CVE-2025-46718: Sudo-rs Information Disclosure Vulnerability

CVE-2025-46718 Overview

CVE-2025-46718 is an information disclosure vulnerability in sudo-rs, a memory-safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with limited sudo privileges (such as execution of a single command) can list sudo privileges of other users using the -U flag. This vulnerability allows enumeration of the sudoers file, revealing sensitive information about other users' permissions that could be leveraged for more targeted attacks.

Critical Impact
Users with limited sudo privileges can enumerate the sudoers file to discover permissions of other users, enabling reconnaissance for privilege escalation attacks.

Affected Products

sudo-rs versions prior to 0.2.6
Trifectatech Sudo (Rust implementation)
Systems with users configured with limited sudo privileges

Discovery Timeline

2025-05-12 - CVE-2025-46718 published to NVD
2025-07-09 - Last updated in NVD database

Technical Details for CVE-2025-46718

Vulnerability Analysis

This vulnerability represents an information exposure flaw (CWE-497) in sudo-rs where the authorization check for the -U flag functionality is insufficient. The -U flag allows users to query sudo privileges for a specified user. In vulnerable versions, users with any level of sudo access—even limited to executing a single specific command—can use this flag to enumerate privileges of other users on the system.

The attack requires local access and low privileges, meaning an authenticated user with minimal sudo access can exploit this flaw. However, the impact is limited to confidentiality exposure of privilege configurations without directly enabling integrity violations or denial of service.

Notably, systems where users either have no sudo privileges at all or have full root access through sudo (the default configuration on most systems) are not affected by this vulnerability.

Root Cause

The root cause stems from an insufficient authorization check in the sudo-rs privilege query mechanism. When processing the -U flag to list another user's privileges, the application fails to properly verify whether the requesting user should have access to view that information. While the application correctly requires some level of sudo access to use the feature, it does not restrict users with limited privileges from viewing the full scope of other users' sudo configurations.

Attack Vector

The attack vector is local, requiring an authenticated user with limited sudo privileges on the target system. The attacker can exploit this vulnerability by executing a simple sudo command with the -U flag followed by a target username.

The exploitation workflow involves:

An attacker gains access to an account with limited sudo privileges (e.g., permission to run a single command as root)
The attacker uses the -U flag to query sudo privileges of other users
The sudoers file contents are exposed, revealing which users have elevated privileges and for which commands
This information enables the attacker to identify high-value targets for further privilege escalation attempts

For technical details on the vulnerability mechanism, see the GitHub Security Advisory.

Detection Methods for CVE-2025-46718

Indicators of Compromise

Unusual usage of sudo -U commands by users with limited sudo privileges
Repeated queries of different usernames via the -U flag from a single user account
Audit log entries showing privilege enumeration attempts across multiple users

Detection Strategies

Monitor sudo command logs for -U flag usage, particularly from accounts with restricted sudo access
Implement audit rules to track sudo invocations with user enumeration flags
Review authentication logs for patterns indicating reconnaissance activity
Configure alerting for any sudo privilege queries performed by non-administrative users

Monitoring Recommendations

Enable comprehensive sudo logging with log_input and log_output options where supported
Deploy host-based intrusion detection to identify unusual sudo command patterns
Regularly audit sudoers configurations to identify accounts with limited but exploitable access
Implement SentinelOne endpoint protection to detect and alert on suspicious privilege enumeration behavior

How to Mitigate CVE-2025-46718

Immediate Actions Required

Upgrade sudo-rs to version 0.2.6 or later immediately
Audit current sudo-rs deployment versions across all systems
Review logs for any historical exploitation attempts using the -U flag
Identify users with limited sudo privileges who may have been able to exploit this vulnerability

Patch Information

The vulnerability is fixed in sudo-rs version 0.2.6. The patch addresses the authorization bypass by implementing proper access controls on the -U flag functionality. Update to the fixed version by obtaining the release from the official sudo-rs releases page.

For additional details and guidance, refer to the GitHub Security Advisory GHSA-w9q3-g4p5-5q2r.

Workarounds

If upgrading immediately is not possible, review and restrict the sudoers configuration to minimize users with limited sudo access
Consider temporarily removing sudo-rs and reverting to traditional sudo if the patch cannot be applied promptly
Implement strict monitoring of -U flag usage to detect exploitation attempts
Restrict shell access for accounts that only require specific sudo command execution

bash

# Verify current sudo-rs version
sudo --version

# Update sudo-rs to patched version 0.2.6 or later
# Follow your distribution's package management or build from source
cargo install sudo-rs --version 0.2.6