Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation

 1title: Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation
 2id: 10ac0730-c24e-4f4c-81f8-b13a1ac95a1d
 3status: experimental
 4description: |
 5    Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463.
 6    This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations.
 7    When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment,
 8    potentially leading to arbitrary code execution and privilege escalation.    
 9references:
10    - https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh
11author: Swachchhanda Shrawn Poudel (Nextron Systems)
12date: 2025-10-02
13modified: 2026-10-19
14tags:
15    - attack.privilege-escalation
16    - attack.t1068
17    - cve.2025-32463
18    - detection.emerging-threats
19logsource:
20    category: file_event
21    product: linux
22detection:
23    selection:
24        TargetFilename|endswith: '/etc/nsswitch.conf'
25    filter_main_legitimate_path:
26        TargetFilename:
27            - '/etc/nsswitch.conf'
28            - '/usr/etc/nsswitch.conf'
29            - '/usr/share/factory/etc/nsswitch.conf'
30    filter_optional_snapshot:
31        TargetFilename|startswith: '/.snapshots/'
32        TargetFilename|endswith: '/snapshot/etc/nsswitch.conf'
33    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
34falsepositives:
35    - Backup locations
36level: high