Quick answer: CVE-2021-3156 is a local privilege-escalation flaw in affected sudo versions, disclosed in January 2021. Upstream fixed it in 1.9.5p2; distribution vendors may backport the fix, so verify your installed package against the vendor advisory.
What Happened?
CVE-2021-3156, also known as Baron Samedit, is a heap-based buffer overflow in sudo disclosed in January 2021. A local attacker could exploit affected versions to obtain elevated privileges. This is a historical vulnerability with released fixes.
In brief, sudo is used to run commands with privileged access, it can also be used to spawn an interactive privileged shell in the current terminal (a shell within your shell if you want to think about it in Inception terms). By manipulating arguments, and the logical flow ofsudowhile it's keeping track of state (which flags are set, etc.), it is possible to create a heap overflow condition; which, when successfully exploited, returns a privileged shell to the user.
The Technical Details
From https://www.sudo.ws/alerts/unescape_overflow.html:
When sudo runs a command in shell mode, either via the -s or -i command line option, it escapes special characters in the command's arguments with a backslash. The sudoers policy plugin will then remove the escape characters from the arguments before evaluating the sudoers policy (which doesn't expect the escape characters) if the command is being run in shell mode.
A bug in the code that removes the escape characters will read beyond the last character of a string if it ends with an unescaped backslash character. Under normal circumstances, this bug would be harmless since sudo has escaped all the backslashes in the command's arguments. However, due to a different bug, this time in the command line parsing code, it is possible to run sudoedit with either the -s or -i options, setting a flag that indicates shell mode is enabled. Because a command is not actually being run, sudo does not escape special characters. Finally, the code that decides whether to remove the escape characters did not check whether a command is actually being run, just that the shell flag is set. This inconsistency is what makes the bug exploitable.
Qualys researchers have also published a full (very technical) writeup about the perfect storm of conditions that are needed to successfully exploit this bug. You can read that information here.
What do you do about it?
Upstream sudo 1.9.5p2 fixed the flaw. Use your operating-system vendor’s security advisory and supported package updates: distributions may backport fixes, so an older-looking upstream version string does not by itself prove that an installed package is vulnerable.
Alternatively, you can download the latest source code here: https://www.sudo.ws/download.html#source
Practical next steps
- Inventory affected hosts and obtain updates from the supported operating-system vendor.
- Verify the package fix rather than comparing upstream version numbers alone.
- Investigate suspicious privileged activity and keep the broader system supported and patched.
Frequently asked questions
Was sudo 1.9.5p1 the fixed release?
No. The upstream fix was released in 1.9.5p2. Supported distributions may include backported fixes under different package versions.
Can this flaw be exploited without any local foothold?
It is a local privilege-escalation vulnerability. An attacker needs the ability to run code locally; another compromise may provide that foothold.
Further reading: Official guidance and reference
