CVE-2025-64517
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
sudo-rs is a memory-safe implementation of sudo and su written in Rust. With `Defaults targetpw` (or `Defaults rootpw`) enabled, sudo-rs versions 0.2.5 through before 0.2.10 incorrectly recorded the invoking user's UID instead of the authenticated-as user's UID in the authentication timestamp. A later sudo invocation on the same terminal while the timestamp was still valid could use it and bypass required re-authentication. Version 0.2.10 contains a patch; versions prior to 0.2.5 are not affected because they do not offer these options.
Risk Assessment
A highly privileged user who knows one password could run commands as other accounts permitted by policy without knowing their passwords, weakening access control. This may lead to privilege escalation in environments using targetpw or rootpw.
Recommendation
Update sudo-rs to version 0.2.10 or later. Review `Defaults targetpw` and `Defaults rootpw` configuration and restrict sudo privileges to the necessary minimum.
Other vulnerabilities in sudo-rs
See all- CVE-2025-64170Low
In sudo-rs (a memory-safe sudo and su implementation in Rust) versions 0.2.7 prior to 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur and the entered keystrokes are echoed back to the console. This could reveal partial password information, potentially exposing history files and enabling social engineering or pass-by attacks. Version 0.2.10 fixes the issue.
- CVE-2023-42456Low
In versions of sudo-rs prior to 0.2.1, an issue was discovered where usernames containing '.' and '/' characters could lead to corruption of specific files on the filesystem. A user with such a name could delete a binary file, resulting in its removal from the system.
Original NVD description (English source)
sudo-rs is a memory safe implementation of sudo and su written in Rust. With `Defaults targetpw` (or `Defaults rootpw`) enabled, the password of the target account (or root account) instead of the invoking user is used for authentication. sudo-rs starting in version 0.2.5 and prior to version 0.2.10 incorrectly recorded the invoking user’s UID instead of the authenticated-as user's UID in the authentication timestamp. Any later `sudo` invocation on the same terminal while the timestamp was still valid would use that timestamp, potentially bypassing new authentication even if the policy would have required it. A highly-privileged user (able to run commands as other users, or as root, through sudo) who knows one password of an account they are allowed to run commands as, would be able to run commands as any other account the policy permits them to run commands for, even if they don't know the password for those accounts. A common instance of this would be that a user can still use their own password to run commands as root (the default behaviour of `sudo`), effectively negating the intended behaviour of the `targetpw` or `rootpw` options. Version 0.2.10 contains a patch for the issue. Versions prior to 0.2.5 are not affected, since they do not offer `Defaults targetpw` or `Defaults rootpw`.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS