Debian sudo host option flaw (DSA-5954-1, CVE-2025-32462) and the chroot bug that skipped Debian

On 30 June 2025 Debian published DSA-5954-1 for sudo on Debian 12 (bookworm). It fixes CVE-2025-32462, a bug in the -h/--host option that, depending on your sudoers rules, could allow local privilege escalation. The same day the sudo project disclosed a second, more serious bug in the --chroot option (CVE-2025-32463), which CISA later added to its Known Exploited Vulnerabilities catalog. Debian's security tracker shows that this second bug never affected a released Debian version.

At a glance

What the vulnerabilities are

CVE-2025-32462: the host option. According to the sudo project advisory, -h is meant to be used with -l to list a user's privileges on another host. Because of a bug it was not limited to listing, so a user could run a command, or edit a file with sudoedit, under rules written for a different machine. The user must still be listed in sudoers. Rules whose host field is ALL are not affected; rules that name a specific host other than the current one are. This mainly matters for organisations that share one sudoers file across many machines, or that keep sudoers rules in LDAP or SSSD. Sudo versions 1.8.8 to 1.9.17 are affected upstream.

CVE-2025-32463: the chroot option. The sudo project describes a local privilege escalation through -R/--chroot: a user could make sudo load an /etc/nsswitch.conf from a directory they control and run commands as root even without a sudoers entry. It affects sudo 1.9.14 to 1.9.17, has a CNA score of 9.3 (Critical), and CISA added it to the KEV catalog on 29 September 2025. Debian's tracker marks bookworm and bullseye as not affected because the vulnerable code was introduced later, and records the fix in 1.9.16p2-3, the version trixie is based on.

Are you affected?

Check the installed version and compare it with the fixed one:

dpkg-query -W -f='${Package} ${Version}\n' sudo sudo-ldap 2>/dev/null
apt policy sudo

Then look at the rules themselves. Print every active line in sudoers and check the host field (the part before =):

sudo grep -rnEv '^[[:space:]]*(#|Defaults|$)' /etc/sudoers /etc/sudoers.d/

A line such as bob ALL = ALL is not affected; alice cerebus = ALL on a machine that is not cerebus is the risky pattern. If your rules come from LDAP or SSSD, review them there.

How to update

sudo apt update
sudo apt install --only-upgrade sudo
apt policy sudo

Debian has since shipped further sudo fixes through regular stable updates rather than a DSA. CVE-2026-35535 (a privilege drop failure before running the mailer; CNA score 7.4 High) is fixed in bookworm 1.9.13p3-1+deb12u4 and trixie 1.9.16p2-3+deb13u2, so those are the versions to aim for today. The tracker also lists CVE-2026-96512, about NOTBEFORE/NOTAFTER rules whose timestamps omit the trailing Z, as a minor issue still open on both releases; if you use those options, review them.

Restart or reboot?

Neither. sudo is not a service; the new binary is used the next time someone runs it.

Sources

• security-tracker.debian.org/tracker/DSA-5954-1
• lists.debian.org/debian-security-announce/2025/msg00118.html
• debian.org/security/2025/dsa-5954
• security-tracker.debian.org/tracker/DLA-4235-1
• security-tracker.debian.org/tracker/CVE-2025-32462
• security-tracker.debian.org/tracker/CVE-2025-32463
• security-tracker.debian.org/tracker/CVE-2026-35535
• security-tracker.debian.org/tracker/CVE-2026-96512
• security-tracker.debian.org/tracker/source-package/sudo
• sudo.ws/security/advisories/host_any
• sudo.ws/security/advisories/chroot_bug
• cve.org/CVERecord?id=CVE-2025-32462
• cve.org/CVERecord?id=CVE-2025-32463
• cve.org/CVERecord?id=CVE-2026-35535
• cve.org/CVERecord?id=CVE-2026-96512
• nvd.nist.gov/vuln/detail/CVE-2025-32462
• cisa.gov/known-exploited-vulnerabilities-catalog
• packages.debian.org/source/bookworm/sudo