CVE-2021-3156: Sudo Heap-Based Buffer Overflow Vulnerability
A heap-based buffer overflow was found in the way sudo parses command line arguments.
As per the researcher this vulnerability:
- is exploitable by any local user (normal users and system users, sudoers and non-sudoers), without authentication (i.e., the attacker does not need to know the user's password);
- was introduced in July 2011 (commit 8255ed69), and affects all legacy versions from 1.8.2 to 1.8.31p2 and all stable versions from 1.9.0 to 1.9.5p1, in their default configuration.
This could lead to privilege escalation.
Other sources
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.
— CISA
Sudo is vulnerable to a heap-based buffer overflow, caused by improper bounds checking when parsing command line arguments. By sending an "sudoedit -s" and a command-line argument that ends with a single backslash character, a local attacker could overflow a buffer and execute arbitrary code on the system with root privileges.
This vulnerability is also known as Baron Samedit.
— IBM
Sudo. This issue was addressed by updating to sudo version 1.9.5p2.
Credit
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-3156.
What is the title of this vulnerability?
The title of this vulnerability is Sudo Heap-Based Buffer Overflow Vulnerability.
What is the description of this vulnerability?
The description of this vulnerability is that Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.
Which software is affected by this vulnerability?
The affected software includes Sudo, macOS Big Sur (up to version 11.2.1), macOS Catalina Supplemental Update (up to version 10.15.7), and macOS Mojave (up to version 10.14.6).
Where can I find more information about this vulnerability?
More information about this vulnerability can be found at the following reference: [https://support.apple.com/en-us/HT212177](https://support.apple.com/en-us/HT212177).