CVE-2025-65807
📋 TL;DR
This vulnerability in sd command v1.0.0 and earlier allows attackers to escalate privileges to root via specially crafted commands. It affects systems where sd command is installed and accessible to users with limited privileges. The vulnerability enables local privilege escalation attacks.
💻 Affected Systems
- sd command-line tool
📦 What is this software?
Sd by Chmln
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root access, allowing attackers to install persistent backdoors, access all data, and control the entire system.
Likely Case
Local privilege escalation where a low-privileged user gains root access, potentially leading to lateral movement within the network.
If Mitigated
Limited impact if proper privilege separation and access controls prevent unauthorized users from executing sd commands.
🎯 Exploit Status
Exploit requires local access to the system and ability to execute sd command. The GitHub gist reference likely contains proof-of-concept code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.0.1 or later
Vendor Advisory: https://github.com/chmln/sd
Restart Required: No
Instructions:
1. Check current sd version: sd --version
2. Update sd using package manager: sudo apt update && sudo apt upgrade sd (Debian/Ubuntu) or equivalent for your distribution
3. Alternatively, download latest release from GitHub: https://github.com/chmln/sd/releases
🔧 Temporary Workarounds
Remove setuid/setgid permissions
linuxRemove special privileges from sd binary to prevent privilege escalation
sudo chmod u-s,g-s $(which sd)
Restrict sd command access
linuxLimit which users can execute sd command
sudo chmod 750 $(which sd)
sudo chown root:trustedgroup $(which sd)
🧯 If You Can't Patch
- Remove sd command from systems where it's not essential
- Implement strict access controls and monitor for suspicious privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check sd version: sd --version | grep -E '1\.0\.0|earlier'Check Version:
sd --versionVerify Fix Applied:
Verify sd version is 1.0.1 or later: sd --version📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts
- sd command execution with suspicious arguments
- Failed sudo/su attempts followed by sd usage
Network Indicators:
- Not applicable - local privilege escalation
SIEM Query:
process.name="sd" AND (user.name!="root" AND process.parent.name!="root")