Insufficient Logging in sudo-rs - CVE-2025-64517
Published: November 12, 2025
Vulnerability identifier: #VU118371
CSH Severity: Low
CVSS v4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-64517
CWE-ID: CWE-778
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to hide their activity on the system.
The vulnerability exists due to sude-rs records the invoking user's UID instead of the authenticated-as user's UID in the authentication timestamp with Defaults targetpw (or Defaults rootpw) enabled. A local privileged user can run commands as any other account the policy permits them to run commands for, even if they don't know the password for those accounts.
Affected software
sudo-rs
Debian Linux
Ubuntu
Fedora
rust-sudo-rs (Debian package)
rust-sudo-rs (Ubuntu package)
sudo-rs
Debian Linux
Ubuntu
Fedora
rust-sudo-rs (Debian package)
rust-sudo-rs (Ubuntu package)
sudo-rs
How to mitigate CVE-2025-64517
Install updates from vendor's website.
sudo-rs - update to 0.2.10
rust-sudo-rs (Debian package) - update to 0.2.5-5+deb13u1
rust-sudo-rs (Ubuntu package) - update to 0.2.8-1ubuntu5.2
sudo-rs - addressed in versions 0.2.10-1.fc41, 0.2.10-1.fc42, 0.2.10-1.fc43
rust-sudo-rs (Debian package) - update to 0.2.5-5+deb13u1
rust-sudo-rs (Ubuntu package) - update to 0.2.8-1ubuntu5.2
sudo-rs - addressed in versions 0.2.10-1.fc41, 0.2.10-1.fc42, 0.2.10-1.fc43