trifectatechfoundation sudo-rs up to 0.2.9 improper authentication

Summaryinfo

A vulnerability categorized as critical has been discovered in trifectatechfoundation sudo-rs up to 0.2.9. The impacted element is an unknown function. Executing a manipulation can lead to improper authentication. The identification of this vulnerability is CVE-2025-64517. The attack can only be executed locally. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in trifectatechfoundation sudo-rs up to 0.2.9 and classified as critical. This vulnerability affects an unknown functionality. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

sudo-rs is a memory safe implementation of sudo and su written in Rust. With `Defaults targetpw` (or `Defaults rootpw`) enabled, the password of the target account (or root account) instead of the invoking user is used for authentication. sudo-rs starting in version 0.2.5 and prior to version 0.2.10 incorrectly recorded the invoking user’s UID instead of the authenticated-as user's UID in the authentication timestamp. Any later `sudo` invocation on the same terminal while the timestamp was still valid would use that timestamp, potentially bypassing new authentication even if the policy would have required it. A highly-privileged user (able to run commands as other users, or as root, through sudo) who knows one password of an account they are allowed to run commands as, would be able to run commands as any other account the policy permits them to run commands for, even if they don't know the password for those accounts. A common instance of this would be that a user can still use their own password to run commands as root (the default behaviour of `sudo`), effectively negating the intended behaviour of the `targetpw` or `rootpw` options. Version 0.2.10 contains a patch for the issue. Versions prior to 0.2.5 are not affected, since they do not offer `Defaults targetpw` or `Defaults rootpw`.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-64517 since 11/05/2025. The exploitation appears to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 274962 (Linux Distros Unpatched Vulnerability : CVE-2025-64517 (deprecated)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.2.10 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the vulnerability database at Tenable (274962). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System Utility Software

Vendor

• trifectatechfoundation

Name

• sudo-rs

Version

• 0.2.0
• 0.2.1
• 0.2.2
• 0.2.3
• 0.2.4
• 0.2.5
• 0.2.6
• 0.2.7
• 0.2.8
• 0.2.9

Website

• Product: https://github.com/trifectatechfoundation/sudo-rs/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion