CVE-2021-3156 – Baron Samedit

Heap-Based Buffer Overflow in sudo | Exploitation & Mitigation Analysis

Overview

CVE-2021-3156, known as Baron Samedit, is a heap-based buffer overflow vulnerability in the sudo program. It allows any unprivileged local user to gain root privileges on vulnerable systems without authentication.

This project documents the full exploitation and mitigation of this vulnerability as part of the Software Vulnerabilities: Exploitation and Mitigation course at the University of Luxembourg.

Vulnerability Details

Environment & Setup

OS:           Ubuntu 20.04.1
sudo version: 1.8.31-1ubuntu1 (vulnerable)
libc version: 2.31
User:         Non-root account

To reproduce the vulnerable state:

sudo apt install sudo=1.8.31-1ubuntu1

How the Vulnerability Works

The vulnerability is triggered when sudo is executed in sudoedit mode with carefully crafted command-line arguments that overflow internal heap buffers.

The exploit uses four critical parameters fine-tuned through memory analysis:

Exploit Structure

exploit_launcher.c — Main Exploit

Triggers the vulnerability through 5 steps:

1. Target Specification — Hardcoded values calculated for Ubuntu 20.04.1 with sudo 1.8.31 and libc-2.31
2. Argument Construction — Creates crafted command-line arguments with backslashes to trigger the overflow
3. Environment Setup — Fills environment with backslashes and a special string to load the malicious library
4. Locale Variable — Crafts LC_ALL to control heap memory layout
5. Execution — Calls sudoedit with the malicious arguments and environment

exploit_payload.c — Malicious Payload

Executed automatically when the exploit succeeds via _init function:

1. Sets all user/group IDs to 0 (root)
2. Spawns a root shell

Exploitation Result

$ make
$ ./exploit_it

[!] CVE-2021-3156 Exploit
[+] Target: Ubuntu 20.04.1 (sudo 1.8.31, libc-2.31)
[+] Parameters: A=56, B=54, Nulls=63, LC_ALL=212
[+] Launching exploit...
[+] Exploit successful. Root privileges obtained.
# whoami
root

✅ Successfully escalated from unprivileged user to root.

Mitigation & Patch Verification

Upgrade sudo to the patched version:

sudo apt install sudo=1.8.31-1ubuntu1.5

After upgrading, the same exploit failed to execute and root privileges were not granted — confirming the patch is effective.

Key takeaway: Keeping system utilities like sudo up to date is critical for preventing privilege escalation attacks.

Files

├── exploit_launcher.c    # Main exploit triggering the heap overflow
├── exploit_payload.c     # Malicious payload spawning root shell
├── libnss_X/             # Malicious library loaded during exploitation
└── Makefile              # Build configuration

Build & Run

# Build
make

# Run exploit
./exploit_it

References

• Qualys Security Advisory
• NVD – CVE-2021-3156