{"id":31464,"date":"2021-01-27T16:27:24","date_gmt":"2021-01-27T21:27:24","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=31464"},"modified":"2021-07-06T16:49:56","modified_gmt":"2021-07-06T20:49:56","slug":"heap-based-buffer-overflow-in-sudo","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2021\/01\/27\/heap-based-buffer-overflow-in-sudo\/","title":{"rendered":"Heap-based Buffer Overflow in Sudo"},"content":{"rendered":"

Animesh Jain<\/a> (via David Smith<\/a>, Hacker News<\/a>):<\/p>\n

Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host.<\/p>\n

[…]<\/p>\n

In other words, set_cmnd()<\/code> is vulnerable to a heap-based buffer overflow, because the out-of-bounds characters that are copied to the “user_args” buffer were not included in its size (calculated at lines 852-853).<\/p>\n

In theory, however, no command-line argument can end with a single backslash character: if MODE_SHELL<\/code> or MODE_LOGIN_SHELL<\/code> is set (line 858, a necessary condition for reaching the vulnerable code), then MODE_SHELL<\/code> is set (line 571) and parse_args()<\/code> already escaped all meta-characters, including backslashes (i.e., it escaped every single backslash with a second backslash).<\/p>\n

In practice, however, the vulnerable code in set_cmnd()<\/code> and the escape code in parse_args()<\/code> are surrounded by slightly different conditions[…]<\/p><\/blockquote>\n\n

jeffbee<\/a>:<\/p>\n

\n

All you need to know about sudo and frankly most other pieces of the Linux userspace is that it is undertested. The commit that added this flaw to sudo claims to fix a parser bug but includes no tests. There is no reason for the author, the reviewer (if there even was such a person), or anyone else to believe that the bug existed or was fixed by this change. The pull request that supposedly fixes this CVE also includes no tests. There is no<\/em> reason anyone should believe this fix is effective or complete, or that it does not introduce new defects.<\/p>\n<\/blockquote>\n\n

Update (2021-02-05): Patrick Wardle<\/a>:<\/p>\n

\n

macOS (including 11.2) appears to be vulnerable to the sudo heap-overflow bug (CVE-2021-3156) 🍎🐛 🤨<\/p>\n<\/blockquote>\n\n

Hartley Charlton<\/a>:<\/p>\n

\n

With some minor modifications, Hickey found that the sudo bug could be used to grant attackers access to macOS root accounts, and the discovery has now been verified by Carnegie Mellon University vulnerability analyst Will Dormann.<\/p>\n<\/blockquote>","protected":false},"excerpt":{"rendered":"

Animesh Jain (via David Smith, Hacker News): Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host. […] In other words, set_cmnd() is vulnerable to a heap-based buffer overflow, because the out-of-bounds characters that are copied to the “user_args” buffer were not included in its size (calculated at […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2021-01-27T21:27:27Z","apple_news_api_id":"6eed7f71-73d7-42d5-9ce7-f5b9b899a035","apple_news_api_modified_at":"2021-07-06T20:49:59Z","apple_news_api_revision":"AAAAAAAAAAAAAAAAAAAAAg==","apple_news_api_share_url":"https:\/\/apple.news\/Abu1_cXPXQtWc5_W5uJmgNQ","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[4],"tags":[131,45,2095,448,30,1891,270,71,582,268],"class_list":["post-31464","post","type-post","status-publish","format-standard","hentry","category-programming-category","tag-bug","tag-c","tag-exploit","tag-linux","tag-mac","tag-macos-11-0","tag-parser","tag-programming","tag-sudo","tag-testing"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/31464","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=31464"}],"version-history":[{"count":2,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/31464\/revisions"}],"predecessor-version":[{"id":31551,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/31464\/revisions\/31551"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=31464"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=31464"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=31464"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}