Skip to main content

Two Sudo Vulnerabilities Discovered and Patched

1 week ago
In April researchers responsibly disclosed two security flaws found in Sudo "that could enable local attackers to escalate their privileges to root on susceptible machines," reports The Hacker News. "The vulnerabilities have been addressed in Sudo version 1.9.17p1 released late last month." Stratascale researcher Rich Mirch, who is credited with discovering and reporting the flaws, said CVE-2025-32462 has managed to slip through the cracks for over 12 years. It is rooted in the Sudo's "-h" (host) option that makes it possible to list a user's sudo privileges for a different host. The feature was enabled in September 2013. However, the identified bug made it possible to execute any command allowed by the remote host to be run on the local machine as well when running the Sudo command with the host option referencing an unrelated remote host. "This primarily affects sites that use a common sudoers file that is distributed to multiple machines," Sudo project maintainer Todd C. Miller said in an advisory. "Sites that use LDAP-based sudoers (including SSSD) are similarly impacted." CVE-2025-32463, on the other hand, leverages Sudo's "-R" (chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file. It's also a critical-severity flaw. "The default Sudo configuration is vulnerable," Mirch said. "Although the vulnerability involves the Sudo chroot feature, it does not require any Sudo rules to be defined for the user. As a result, any local unprivileged user could potentially escalate privileges to root if a vulnerable version is installed...." Miller said the chroot option will be removed completely from a future release of Sudo and that supporting a user-specified root directory is "error-prone."

Read more of this story at Slashdot.

EditorDavid

Nuclear Microreactors Advance as US Picks Two Companies for Fueled Testing

1 week ago
This week America's Energy Department selected two companies to perform the first nuclear microreactor tests in a new facility in Idaho, saying the tests "will fast-track the deployment of American microreactor technologies... The first fueled reactor experiment will start as early as spring 2026." The new facility is named DOME (an acronym for Demonstration of Microreactor Experiments), and it leverages existing "to safely house and test fueled reactor experiments, capable of producing up to 20 megawatts of thermal energy," according to a local newspaper. [T]wo companies were competitively selected in 2023 and are currently working through a multi-phase Energy Department authorization process to support the design, fabrication, construction, and testing of each fueled reactor experiment. Both are expected to meet certain milestones throughout the process to maintain their allotted time in DOME and to ensure efficient use of the test bed, according to the release... The department estimates each DOME reactor experiment will operate up to six months, with the DOME test bed currently under construction and on track to receive its first experiment in early 2026... The next call for applications is anticipated to be in 2026. The site Interesting Engineering calls the lab "a high-stakes proving ground to accelerate the commercialization of advanced microreactors..." Based in Etna, Pennsylvania, Westinghouse will test its eVinci Nuclear Test Reactor, a compact, transportable microreactor that uses advanced heat pipe technology for passive cooling. Designed to deliver 5 megawatts of electricity on sites as small as two acres, eVinci could support applications ranging from remote communities to mining operations and data centers. Meanwhile, Radiant (El Segundo, California) will test its Kaleidos Development Unit, a 1.2 megawatt electric high-temperature gas reactor aimed at replacing diesel generators. Designed to run for five years, Kaleidos is fueled by TRISO fuel particles that could offer reliable backup power for hospitals, military bases, and other critical infrastructure. Radiant's CEO said "In short order, we will fuel, go critical, and operate, leading to the mass production of portable reactors which will jumpstart American nuclear energy dominance."

Read more of this story at Slashdot.

EditorDavid