CVE-2025-64170

sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens, the keystrokes that were entered are echoed back to the console. This could reveal partial password information, possibly exposing history files when not carefully handled by the user and on screen, usable for Social Engineering or Pass-By attacks. Version 0.2.10 fixes the issue.

CVSS v3 3.8 LOW

3.8^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.1 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10
https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-c978-wq47-pvvw

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) sudo-rs es una implementación de sudo y su segura para la memoria escrita en Rust. A partir de la versión 0.2.7 y antes de la versión 0.2.10, si un usuario comienza a introducir una contraseña pero no presiona 'enter' durante un período prolongado, puede producirse un tiempo de espera de la contraseña. Cuando esto sucede, las pulsaciones de teclas que se introdujeron se hacen eco en la consola. Esto podría revelar información parcial de la contraseña, posiblemente exponiendo archivos de historial cuando no se maneja con cuidado por parte del usuario y en pantalla, utilizable para ataques de ingeniería social o Pass-By. La versión 0.2.10 corrige el problema.

Information

Published : 2025-11-12 21:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-64170

Mitre link : CVE-2025-64170

CVE.ORG link : CVE-2025-64170

JSON object : View

Products Affected

No product.

CWE

CWE-549

Missing Password Field Masking

{"id": "CVE-2025-64170", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64170", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-14T17:34:17.406557Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "trifectatechfoundation", "product": "sudo-rs", "versions": [{"status": "affected", "version": ">= 0.2.7, < 0.2.10"}]}]}], "published": "2025-11-12T21:15:53.433", "references": [{"url": "https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10", "source": "security-advisories@github.com"}, {"url": "https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-c978-wq47-pvvw", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-549"}]}], "descriptions": [{"lang": "en", "value": "sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens, the keystrokes that were entered are echoed back to the console. This could reveal partial password information, possibly exposing history files when not carefully handled by the user and on screen, usable for Social Engineering or Pass-By attacks. Version 0.2.10 fixes the issue."}, {"lang": "es", "value": "sudo-rs es una implementaci\u00f3n de sudo y su segura para la memoria escrita en Rust. A partir de la versi\u00f3n 0.2.7 y antes de la versi\u00f3n 0.2.10, si un usuario comienza a introducir una contrase\u00f1a pero no presiona 'enter' durante un per\u00edodo prolongado, puede producirse un tiempo de espera de la contrase\u00f1a. Cuando esto sucede, las pulsaciones de teclas que se introdujeron se hacen eco en la consola. Esto podr\u00eda revelar informaci\u00f3n parcial de la contrase\u00f1a, posiblemente exponiendo archivos de historial cuando no se maneja con cuidado por parte del usuario y en pantalla, utilizable para ataques de ingenier\u00eda social o Pass-By. La versi\u00f3n 0.2.10 corrige el problema."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "security-advisories@github.com"}