CVE-2025-49809: mtr Network Tool RCE Vulnerability

CVE-2025-49809 Overview

CVE-2025-49809 affects mtr through version 0.95, a widely used network diagnostic tool that combines ping and traceroute functionality. The vulnerability stems from mishandled execution of a program specified by the MTR_PACKET environment variable in certain privileged contexts. Attackers with limited sudo rights to run mtr can leverage this environment variable to execute arbitrary programs with elevated privileges. The issue is particularly relevant on macOS systems where Homebrew does not install setuid binaries, making sudo rules a common deployment pattern for mtr. The weakness is classified under [CWE-829: Inclusion of Functionality from Untrusted Control Sphere].

Critical Impact
Local attackers with restricted sudo privileges for mtr can escalate to root by controlling the MTR_PACKET environment variable to execute arbitrary binaries.

Affected Products

mtr through version 0.95
mtr deployments on macOS installed via Homebrew (without setuid)
Linux systems where mtr is exposed via restricted sudo rules

Discovery Timeline

2025-07-04 - CVE-2025-49809 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49809

Vulnerability Analysis

The mtr utility supports the MTR_PACKET environment variable to specify the path to the mtr-packet helper executable. This design assists developers debugging changes to mtr-packet. When mtr is not installed setuid-root but is instead invoked through sudo, the parent process retains its environment. The child mtr process reads MTR_PACKET and executes the referenced binary with root privileges. An attacker who compromises a limited user account with a sudo rule for mtr can point MTR_PACKET at an attacker-controlled executable. The mechanism converts a narrowly scoped sudo permission into arbitrary root code execution [CWE-829].

Root Cause

The root cause is the unconditional trust placed in the MTR_PACKET environment variable when mtr executes in a privileged context. The program does not detect whether it is running under sudo and does not sanitize inherited environment variables before choosing which helper binary to spawn.

Attack Vector

Exploitation requires local access and a sudo rule permitting the attacker to run mtr. The attacker sets MTR_PACKET to a malicious binary and invokes mtr through sudo. The malicious binary then executes with root privileges. Attack complexity is high because the deployment must expose mtr through sudo without stripping the environment via env_reset or secure_path handling.

        the path to the mtr-packet executable.  This is necessary
        for debugging changes for mtr-packet.
      */
-    char *mtr_packet_path = getenv("MTR_PACKET");
-    if (mtr_packet_path == NULL) {
+    char * mtr_packet_path = NULL; 
+
+    // In the rare case that mtr-packet is not setuid-root, 
+    // and a select group of users has sudo privileges to run 
+    // mtr and not much else, THEN create /etc/mtr.is.run.under.sudo
+    // to prevent a privilege escalation when one of those accounts
+    // is compromised.  CVE-2025-49809
+    if (access ("/etc/mtr.is.run.under.sudo", F_OK) != 0)
+        mtr_packet_path = getenv("MTR_PACKET");
+    if (mtr_packet_path == NULL)
         mtr_packet_path = "mtr-packet";
-    }
 
     /*
        First, try to execute mtr-packet from PATH

Source: GitHub MTR Commit 5226f105 — the patch introduces a sentinel file check at /etc/mtr.is.run.under.sudo that disables reading MTR_PACKET when present.

Detection Methods for CVE-2025-49809

Indicators of Compromise

Execution of mtr via sudo with a non-empty MTR_PACKET environment variable set by the invoking user
Root-owned processes spawning from unexpected paths such as /tmp, user home directories, or world-writable locations following an mtr invocation
Shell history entries showing MTR_PACKET= assignments preceding sudo mtr calls

Detection Strategies

Audit sudoers configurations for entries that grant mtr execution without env_reset or with SETENV privileges
Correlate execve audit events where the parent binary is mtr and the child is not mtr-packet in a system path
Monitor Linux auditd or macOS Endpoint Security events for privileged child processes forked by mtr

Monitoring Recommendations

Collect process creation telemetry with full command line and environment where available, and alert on MTR_PACKET values pointing outside /usr/bin, /usr/sbin, or /usr/local/bin
Baseline expected mtr usage across administrator accounts and flag deviations, particularly interactive invocations from service accounts
Track integrity of /etc/mtr.is.run.under.sudo on patched hosts to confirm the mitigation remains active

How to Mitigate CVE-2025-49809

Immediate Actions Required

Upgrade mtr to a version containing commit 5226f105 or later once distributed by your package maintainer
Create the sentinel file /etc/mtr.is.run.under.sudo on hosts where mtr is exposed through sudo rules to disable MTR_PACKET handling
Review sudoers policies and remove mtr entries from user accounts that do not require network diagnostic privileges

Patch Information

The upstream fix is delivered in GitHub MTR Commit 5226f105. The patch causes mtr to ignore MTR_PACKET when /etc/mtr.is.run.under.sudo exists. Additional guidance is documented in the GitHub MTR Security Notes and the related GitHub Homebrew Issue #35085.

Workarounds

Enforce Defaults env_reset in sudoers and ensure MTR_PACKET is not listed in env_keep
Install mtr-packet as setuid-root where the platform supports it, removing the need for sudo-based invocation
Restrict sudo access to mtr to a narrow administrator group and require explicit NOPASSWD review

bash

# Create the sentinel file to disable MTR_PACKET handling under sudo
sudo touch /etc/mtr.is.run.under.sudo
sudo chmod 644 /etc/mtr.is.run.under.sudo

# Harden sudoers: strip environment on mtr invocations
# /etc/sudoers.d/mtr
Defaults!/usr/sbin/mtr env_reset
%netadmin ALL=(root) NOPASSWD: /usr/sbin/mtr