Memory Leak Vulnerability in sudo-rs Implementation by Trifecta Tech Foundation

CVE-2025-64170

What is CVE-2025-64170?

The sudo-rs application, a secure implementation of sudo and su, contains a vulnerability that affects users' password security. When inputting a password, if the user delays pressing return for too long, it leads to a password timeout. In this circumstance, the entered keystrokes are echoed back to the console, potentially exposing partial password information. This information can be misused, allowing attackers to exploit password history files and conduct social engineering or pass-by attacks. The vulnerability has been addressed in version 0.2.10, highlighting the importance of timely software updates to ensure user security.

References