3.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-64170

CVE-2025-64170: sudo-rs: Partial password reveal is possible after timeout

Summary

If a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens, the keystrokes that were entered are echoed back to the console.

Example

Using sudo-rs:

geiger@cerberus:~$ sudo -s
[sudo: authenticate] Password: sudo-rs: timed out
geiger@cerberus:~$ testtesttest

"testtesttest" was entered at the password prompt but not confirmed by pressing return and then waiting for the timeout.

Impact

This could reveal partial password information, possibly exposing history files when not carefully handled by the user and on screen, usable for Social Engineering or Pass-By attacks.

Versions affected

Passwords timeouts were added in sudo-rs 0.2.7 (with a default set to 5 minutes).

Credits

This issue was discovered and reported by @DevLaTron.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-64170

CVE-2025-64170:

3.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
sudo-rs	rust	>= 0.2.7, < 0.2.10	0.2.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability was caused by a mishandling of terminal modes during password input with a timeout. Specifically, when reading a password without visual feedback (the default sudo prompt), the code did not disable the terminal's canonical mode (ICANON). In canonical mode, the TTY driver performs line buffering, collecting user input until a newline character is entered. The application used a timeout mechanism to abort the password prompt if the user was idle. When a timeout occurred, the application would terminate the read operation and restore the old terminal settings. However, any characters the user had typed were still held in the TTY driver's line buffer. Upon the application restoring the terminal state, this buffer was flushed to the standard output, causing the partial password to be displayed on the screen.

The patch addresses this by ensuring that canonical mode is always disabled when reading a password, regardless of whether visual feedback is enabled. This is done by modifying HiddenInput::new to always unset the ICANON flag. This puts the terminal in non-canonical (raw) mode, where input is available to the application character-by-character. The code was also refactored to use a single, robust function (read_unbuffered) for all password reading, which handles character processing and cleanup correctly, even in the event of a timeout, by using an ExitGuard to ensure no partial input is left on the screen.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

3.8

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-64170: sudo-rs: Partial password reveal is possible after timeout

Summary

Example

Impact

Versions affected

Credits

CVE-2025-64170:

3.8

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

3.8

3.8

Basic Information

Basic Information

CVE-2025-64170: sudo-rs: Partial password reveal is possible after timeout

Summary

Example

Impact

Versions affected

Credits

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI