https://www.phoronix.com/news/sudo-rs-security-ubuntu-25.10 Phoronix * Articles & Reviews * News Archive * Forums * Premium Ad-Free * Contact * Popular Categories * Close * * Articles & Reviews * News Archive * Forums * Premium * Contact * Categories Computers Display Drivers Graphics Cards Linux Gaming Memory Motherboards Processors Software Storage Operating Systems Peripherals * [ ] [Search] sudo-rs Affected By Multiple Security Vulnerabilities - Impacting Ubuntu 25.10 Written by Michael Larabel in Ubuntu on 11 November 2025 at 05:32 PM EST. 113 Comments UBUNTU The Ubuntu 25.10 transition to using some Rust system utilities continues proving quite rocky. Beyond some early performance issues with Rust Coreutils, breakage for some executables, and broken unattended upgrades due to a Rust Coreutils bug, it's also sudo-rs now causing Ubuntu developers some headaches. There are two moderate security issues affecting sudo-rs, the Rust version of sudo being used by Ubuntu 25.10. Initially opened as a private bug report last week was [sudo-rs] Update to address two moderate vulnerabilities. "Upstream will release a fix for two moderate vulnerabilities targeting Friday (Nov 7 2025). The expected coordinated release of this fix is Monday (Nov 10 2025). One of these vulnerabilities is CVE-2025-64170." That bug report has since been made public with the upstream sudo-rs fixes being committed. Ubuntu 25.10 is also seeing a stable release update (SRU) to address these two security issues. One of the patches is to prevent the sudo password from being leaked in case of a timeout or sudo being killed. Another patch is to use enum for the feedback parameter. Another patch to ensure feedback is always erased before exiting the read unbuffered code. Another change is also made to not treat backspace as a password character when the password is empty. sudo-rs on Ubuntu 25.10 I haven't seen any of the CVE reports made public yet for these sudo-rs security issues, but even alone the one for potentially leaking the sudo password in case of timeout or sudo being killed is significant. Released now is sudo-rs 0.2.10 with the latest fixes and other changes. The sudo-rs package for Ubuntu 25.10 is being SRU'ed to users. 113 Comments Tweet Related News Ubuntu Server 25.10 Performance On AMD EPYC With "amd64v3" Optimized Packages Ubuntu Announces Architecture Variants: Ubuntu 25.10 Gets x86_64-v3 Packages Ubuntu Unity In Need Of More Developers To Survive Canonical Academy Announced For New Ubuntu Linux Certifications Ubuntu 25.10 Unattended Upgrades Broken Due To Rust Coreutils Bug Canonical Begins Snap'ing Up Silicon-Optimized AI LLMs For Ubuntu Linux About The Author Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via MichaelLarabel.com. Popular News This Week The Linux Kernel Looks To "Bite The Bullet" In Enabling Microsoft C Extensions GNOME Mutter Now "Completely Drops The Whole X11 Backend" sudo-rs Affected By Multiple Security Vulnerabilities - Impacting Ubuntu 25.10 Hyprland 0.52 Released With New Features For This Wayland Compositor FreeDesktop.org Adopts The Filesystem Hierarchy Standard IncusOS Announced As Immutable Linux OS With ZFS For Running Containers Rust-Based Redox OS Gets Servo Web Engine Running - Sort Of KDE Plasma 6.6 Shaving Off 100MB Of Memory Use, Fixing DrKonqi Crash Reporter Crashing Latest Linux News Mesa 25.2.7 Ships The Latest Open-Source OpenGL & Vulkan Driver Fixes Valve Already Upstreams Support For The New Steam Controller To SDL3 Valve Announces New Steam Machine, Steam Controller & Steam Frame The State Of The Vulkan Renderer For Wayland's Weston 15.0 Compositor Valve's Open-Source Radeon Linux Driver "Love Song For Gamers With Old GPUs" Red Hat's RHEL 10.1 Released With systemd Soft-Reboots, Easier AI Accelerator Drivers RADV Driver Adds Valve Video Extension Used By Steam Link VR Webmin 2.600 Web-Based System Administration Tool Brings "Biggest UI Update" Google Posts Device Trees For Booting Pixel 10 Hardware With The Mainline Linux Kernel sudo-rs Affected By Multiple Security Vulnerabilities - Impacting Ubuntu 25.10 Kaspersky Brings Its Anti-Virus Software To Linux For Home Users Linux 6.18 Merges Fix For "Catastrophic Performance Issue" On 64-bit ARM Intel Releases New CPU Microcode, Publishes 30 New Security Advisories Linux Proposal Aims To Overcome Kernel Limitation Affecting Various Gaming Peripherals Show Your Support, Go Premium Phoronix Premium allows ad-free access to the site, multi-page articles on a single page, and other features while supporting this site's continued operations. Latest Featured Articles Framework Laptop 16 Upgrade To AMD Ryzen AI 300 Series Benchmarks Intel Core Ultra 7 255H Linux CPU Performance Google Cloud N4D Delivers Great VM Performance & Value Powered By AMD EPYC Turin Can openSUSE Tumbleweed Compete With CachyOS Performance? Intel's Rewrite Of Linux MM CID Code Showing Some Nice Gains For AMD Support Phoronix The mission at Phoronix since 2004 has centered around enriching the Linux hardware experience. In addition to supporting our site through advertisements, you can help by subscribing to Phoronix Premium. You can also contribute to Phoronix through tips/donations via PayPal or Stripe. Phoronix Media --------------------------------------------------------------------- * Contact * Michael Larabel Phoronix Premium --------------------------------------------------------------------- * Support Phoronix * While Having Ad-Free Browsing, * Single-Page Article Viewing Share --------------------------------------------------------------------- * Facebook * Twitter / X * Legal Disclaimer, Privacy Policy, Cookies | Privacy Manager | Contact * Copyright (c) 2004 - 2025 by Phoronix Media. * All trademarks used are properties of their respective owners. All rights reserved.