Strix
26.1K

CVE-2025-64170

LOWCVSS 3.8/10EPSS 0.12%

Last modified

CVE-2025-64170 is a low-severity vulnerability rated 3.8/10 on the CVSS scale. sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur. EPSS estimates a 0.12% chance of exploitation in the next 30 days.

Description

sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens, the keystrokes that were entered are echoed back to the console. This could reveal partial password information, possibly exposing history files when not carefully handled by the user and on screen, usable for Social Engineering or Pass-By attacks. Version 0.2.10 fixes the issue.

Metrics

CVSS 3.1
3.8/10

CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

EPSS Probability
0.12%

2.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2025-64170?
sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens, the keystrokes that were entered are echoed back to the console. This could reveal partial password information, possibly exposing history files when not carefully handled by the user and on screen, usable for Social Engineering or Pass-By attacks. Version 0.2.10 fixes the issue.
How severe is CVE-2025-64170?
CVE-2025-64170 has a CVSS score of 3.8/10 (LOW severity). The EPSS model estimates a 0.12% probability of exploitation in the next 30 days.
How do I fix CVE-2025-64170?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-64170?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST