CVE-2025-65807: 
Rust vulnerability analysis and mitigation

CVE-2025-65807 is a local privilege escalation vulnerability in the sd command (a Rust-based sed alternative by chmln), affecting versions 1.0.0 and earlier. The vulnerability allows attackers to escalate privileges by exploiting improper group ownership handling during in-place file modification. It was discovered in November 2025 and publicly disclosed on December 10, 2025. The CVSS v3.1 base score is reported as 8.4 (High) by Feedly/NVD, while the GitHub Advisory Database rates it as 6.5 (Moderate) (Github Advisory, PoC Gist).

The root cause is classified as CWE-266 (Incorrect Privilege Assignment). When sd performs in-place file replacement, it creates a temporary file (e.g., .tmp8EbJhK), applies fchmod to set permissions, and then uses renameat to replace the original file — critically, without calling fchown to restore the original file's group ownership. This contrasts with sed, which explicitly calls fchown to preserve ownership. As a result, the replaced file inherits the group of the process running sd. If an attacker can execute sd as a higher-privileged user (e.g., via a sudo rule), they can manipulate a file's group ownership and, combined with a pre-set SUID bit, escalate privileges. The vulnerability was confirmed via strace analysis comparing sd and sed syscall behavior (PoC Gist, Github Advisory).

Successful exploitation allows a low-privileged local attacker to escalate to the privileges of any user they can invoke sd as via sudo or similar mechanisms, potentially including root. The attacker gains full control over the effective user and group identity of a SUID binary, enabling arbitrary command execution at elevated privilege levels. This compromises confidentiality, integrity, and availability of the affected system. The exploit has been confirmed to work in bash environments but not in zsh (PoC Gist).

A public proof-of-concept exploit is available on GitHub Gist, demonstrating the full privilege escalation chain (PoC Gist). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.039% (low probability of exploitation in the next 30 days). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available via Nessus (plugin 278163) and Qualys (QID 5006570) (Github Advisory).

1. Reconnaissance: Identify systems where the sd command (version ≤ 1.0.0) is installed and where a low-privileged user (e.g., www-data) has sudo rights to run sd as a higher-privileged user (e.g., welcome or root) — check via sudo -l.
2. Prepare SUID binary: As the low-privileged user, copy a shell binary to a world-writable directory: cp /bin/bash /tmp/test/bash1.
3. Set SUID bit: Apply the SUID bit to the copied binary: chmod a+s /tmp/test/bash1. At this point, the file is owned by the low-privileged user's group.
4. Trigger group ownership change: Run sd as the target higher-privileged user with a no-op replacement to force the file's group to change: sudo -u welcome sd '' '' /tmp/test/bash1. The renameat syscall replaces the file without restoring the original group, so the file's group becomes welcome.
5. Execute SUID shell: Run the modified binary with the -p flag to preserve effective privileges: ./bash1 -p. The shell now runs with the effective UID/GID of the welcome user, achieving privilege escalation (PoC Gist).

• File System: Unexpected change in group ownership of files in world-writable directories (e.g., /tmp); presence of SUID binaries (e.g., copies of /bin/bash) in temporary or user-writable directories with group ownership matching a privileged user.
• Logs: sudo log entries showing a low-privileged user invoking sd as a different user with empty or no-op patterns (e.g., sd '' '' <filename>); audit logs showing renameat syscalls on SUID files followed by group ownership changes.
• Process: Unexpected shell processes (e.g., bash -p) spawned by low-privileged users with elevated effective UID/GID; strace or audit records showing fchmod without a corresponding fchown on files being modified by sd (PoC Gist).

The GitHub Advisory Database notes no patched version is currently listed for the sd Cargo package as of the advisory date, though Feedly indicates a patch was added beyond version 1.0.0 (the repository shows v1.1.0 released February 25, 2026) (Github Advisory, sd GitHub). Users should upgrade to v1.1.0 or later. As an immediate workaround, remove or restrict any sudo rules that allow unprivileged users to execute sd as other users, and audit sudoers configurations for sd entries. Apply the principle of least privilege and avoid granting NOPASSWD sudo access to file-manipulation utilities.

Red Hat has acknowledged the vulnerability and published a CVE entry (Red Hat CVE). The GitHub Advisory Database reviewed and published the advisory on December 10, 2025. Researcher faabbi published the PoC and credited Germano0 for performing library tracing (via strace) to explain the underlying syscall behavior difference between sd and sed (PoC Gist). No significant broader media coverage or social media discussion has been identified.