Information disclosure in sudo-rs - CVE-2025-64170
Published: November 12, 2025
Vulnerability identifier: #VU118370
CSH Severity: Low
CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-64170
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker to gain access to potentially sensitive information.
The vulnerability exists due to the way timeouts are implemented. When typing partial passwords but not pressing return for a long time, a password timeout can occur. This results in symbols entered as password to be displayed in the console. An attacker with physical access to the system can observe entered data in the console.
Affected software
sudo-rs
Debian Linux
Ubuntu
Fedora
rust-sudo-rs (Debian package)
rust-sudo-rs (Ubuntu package)
sudo-rs
Debian Linux
Ubuntu
Fedora
rust-sudo-rs (Debian package)
rust-sudo-rs (Ubuntu package)
sudo-rs
How to mitigate CVE-2025-64170
Install updates from vendor's website.
sudo-rs - update to 0.2.10
rust-sudo-rs (Debian package) - update to 0.2.5-5+deb13u1
rust-sudo-rs (Ubuntu package) - update to 0.2.8-1ubuntu5.2
sudo-rs - addressed in versions 0.2.10-1.fc41, 0.2.10-1.fc42, 0.2.10-1.fc43
rust-sudo-rs (Debian package) - update to 0.2.5-5+deb13u1
rust-sudo-rs (Ubuntu package) - update to 0.2.8-1ubuntu5.2
sudo-rs - addressed in versions 0.2.10-1.fc41, 0.2.10-1.fc42, 0.2.10-1.fc43