CVE-2025-64170
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In sudo-rs (a memory-safe sudo and su implementation in Rust) versions 0.2.7 prior to 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur and the entered keystrokes are echoed back to the console. This could reveal partial password information, potentially exposing history files and enabling social engineering or pass-by attacks. Version 0.2.10 fixes the issue.
Risk Assessment
Exposure of partial password information on screen could facilitate social engineering or pass-by attacks, leading to unauthorized access.
Recommendation
Update sudo-rs to version 0.2.10 or later.
Other vulnerabilities in sudo-rs
See all- CVE-2025-64517Medium
sudo-rs is a memory-safe implementation of sudo and su written in Rust. With `Defaults targetpw` (or `Defaults rootpw`) enabled, sudo-rs versions 0.2.5 through before 0.2.10 incorrectly recorded the invoking user's UID instead of the authenticated-as user's UID in the authentication timestamp. A later sudo invocation on the same terminal while the timestamp was still valid could use it and bypass required re-authentication. Version 0.2.10 contains a patch; versions prior to 0.2.5 are not affected because they do not offer these options.
- CVE-2023-42456Low
In versions of sudo-rs prior to 0.2.1, an issue was discovered where usernames containing '.' and '/' characters could lead to corruption of specific files on the filesystem. A user with such a name could delete a binary file, resulting in its removal from the system.
Original NVD description (English source)
sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens, the keystrokes that were entered are echoed back to the console. This could reveal partial password information, possibly exposing history files when not carefully handled by the user and on screen, usable for Social Engineering or Pass-By attacks. Version 0.2.10 fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS