Baron Samedit

CVE-2021–3156

Theory

The "Sudo Baro Samedit" is heap buffer overflow exploit allowing any user to escalate privileges to root. No misconfigurations required, this exploit works with the default settings, for any user regardless of Sudo permissions.

The vulnerability was patched, but it didn’t update the version number for sudo or any other binary. So it’s not possible to tell definitively if a version if vulnerable or not just by version number.It can affects any unpatched version of the sudo program from 1.8.2–1.8.31p2 and 1.9.0–1.9.5p1

Practice

Enumerate

To check the exploitability of sudo, you may run the following commands. If it's returns the sudoedit: /: not a regular file error message, then it’s vulnerable. If it returns the sudoedit usage, it’s not.

sudoedit -s /

Or with the following command, if the system is vulnerable it will overwrite the heap buffer and crash the process:

sudoedit -s '\' $(python3 -c 'print("A"*1000)')

Exploit

References

Exploit Writeup for CVE-2021–3156 (Sudo Baron Samedit)Medium