Hello and welcome to the Thursday, July 3rd, 2025 edition of the Sans Internet Storm Center's

Stormcast. My name is Johannes Ulrich and this episode is brought to you by the Sans.edu

batches degree program in Applied Cybersecurity and it is recorded in Berlin, Germany.

Well, sadly, to start out with, we do have a new vulnerability in the good old Linux command,

Sudo.

This vulnerability was found by Rich Merch with Strata Scale.

It is relatively easy to exploit. Rich also as part of his blog posts, did provide

proof of concept exploit for this particular wantability.

Patches have been made available for all current Linux distributions.

As far as I can tell, some of the older ones are actually

not vulnerable as this particular vulnerability was introduced in a more recent version of

pseudo. The problem with this vulnerability is the change route option. Now, the route in change

route, of course, has nothing to do with the root user.

It's meant to run the command in a more restricted environment.

The problem is that that may give the person running the command actually the ability to map

some files that the user may change to files that the pseudo will then use and execute,

and that's sort of really the problem that has to be addressed in the patch for this vulnerability.

Again, proof of concept export is available, exploitation isn't all that difficult, not 100% clear which exact version

and distribution is vulnerable or not vulnerable.

But in order to exploit the vulnerability, an attacker would just need to have access to any account on the system.

The attacker does not need to have access to an account

with some kind of restricted pseudo privileges.

...