A critical privilege escalation vulnerability in Sudo is being actively exploited in the wild, allowing local users to achieve full root access.

This is an inclusion of functionality from an untrusted control sphere (CWE-829) where the application incorrectly utilizes a user-controlled /etc/nsswitch.conf file during --chroot operations. The vulnerability allows an unprivileged local user to manipulate the environment to execute code with root privileges.

The exploitation of this vulnerability results in full system compromise, as it grants attackers root-level access to the underlying operating system. With a CVSS score of 9.5, this flaw represents a critical threat to data integrity, confidentiality, and system availability. Successful exploitation could lead to unauthorized data exfiltration, permanent system backdoors, and total loss of administrative control over affected servers.

Immediate Action: Upgrade Sudo to version 1.9.17p1 or higher immediately to address the underlying logic error.

Proactive Monitoring: Review system logs for unusual sudo usage patterns or unauthorized attempts to execute chroot commands. Monitor for modifications to sensitive configuration files located in non-standard or user-writable directories.

Compensating Controls: Restrict access to the sudo command and strictly audit chroot environments to ensure they do not contain user-writable configuration files that could influence the execution path.

Public Exploit Available: Yes, a Metasploit module and ExploitDB entry exist.

Given the critical severity of this vulnerability and the confirmed evidence of active exploitation in the wild, immediate patching is mandatory for all affected systems. Administrators should prioritize the deployment of Sudo version 1.9.17p1 across their infrastructure to mitigate the risk of full system compromise. Failure to act promptly significantly increases the probability of successful unauthorized root access by local attackers.