CVE-2021-3156 — Baron Samedit
Heap-Based Buffer Overflow in sudo → Local Privilege Escalation
ITSOLERA Cybersecurity Department | Red Team Internship 2026
██████╗ █████╗ ██████╗ ██████╗ ███╗ ██╗ ███████╗ █████╗ ███╗ ███╗███████╗██████╗ ██╗████████╗
██╔══██╗██╔══██╗██╔══██╗██╔═══██╗████╗ ██║ ██╔════╝██╔══██╗████╗ ████║██╔════╝██╔══██╗██║╚══██╔══╝
██████╔╝███████║██████╔╝██║ ██║██╔██╗ ██║ ███████╗███████║██╔████╔██║█████╗ ██║ ██║██║ ██║
██╔══██╗██╔══██║██╔══██╗██║ ██║██║╚██╗██║ ╚════██║██╔══██║██║╚██╔╝██║██╔══╝ ██║ ██║██║ ██║
██████╔╝██║ ██║██║ ██║╚██████╔╝██║ ╚████║ ███████║██║ ██║██║ ╚═╝ ██║███████╗██████╔╝██║ ██║
╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═════╝ ╚═╝ ╚═╝
⚠️ FOR EDUCATIONAL / ISOLATED LAB USE ONLY
All testing must be performed exclusively inside the Docker lab container.
Never run against real, production, or shared systems.
Table of Contents
- CVE Overview
- What Makes This CVE Special
- Project Structure
- Team Deliverables
- Quick Start
- How the Exploit Works
- Vulnerability Canary Test
- exploit.py Usage
- Lab Reset & Snapshot
- Patched vs Vulnerable Comparison
- References
CVE Overview
What Makes This CVE Special
Key insight: The overflow happens in set_cmnd() — the function that
parses arguments — which runs before sudo ever consults /etc/sudoers.
An account created 10 seconds ago with zero permissions can exploit this.
Project Structure
CVE-2021-3156-Project/
│
├── README.md ← you are here
│
├── lab/ ← Member 1: Lab Environment
│ ├── Dockerfile ← Ubuntu 20.04 + sudo 1.8.31 (pinned)
│ ├── docker-compose.yml ← vulnerable target + patched reference
│ ├── evidence_helper.sh ← pre/post-exploit state capture
│ ├── SETUP.md ← step-by-step VM/Docker guide
│ └── config_notes.md ← CVE conditions & container details
│
├── exploit/ ← Member 2: Exploit Development
│ ├── exploit.py ← Python LPE framework + canary test
│ └── payloads.txt ← heap overflow research notes
│
├── docs/ ← Member 3: Research & Documentation
│ ├── root_cause_analysis.md ← set_cmnd() deep dive + off-by-one
│ ├── references.md ← all sources, PoCs, CWE mapping
│ └── mitigation.md ← sudo upgrade + hardening checklist
│
├── proof/ ← Member 4: Evidence Collection
│ ├── screenshots/ ← exploitation screenshots
│ └── terminal_logs.txt ← command output template + logs
│
└── report/
└── CVE-2021-3156_Report.docx ← Member 4: Final professional report
Team Deliverables
Member 1 — Lab Environment & CVE Verification
Member 2 — Exploit Development (PoC Script)
Note: Working kernel/heap exploit code is not included per ethical guidelines.
The exploit.py TODO stubs reference https://github.com/blasty/CVE-2021-3156
and https://github.com/worawit/CVE-2021-3156 as the authoritative public PoCs
for your team to study and integrate.
Member 3 — Root Cause Analysis & Research
| File | Description |
|---|
docs/root_cause_analysis.md |
Member 4 — Proof Collection, Reporting & Integration
| File | Description |
|---|
proof/terminal_logs.txt | Evidence collection template (fill in with actual lab output) |
proof/screenshots/ | Directory for 7 required screenshots |
report/CVE-2021-3156_Report.docx | 12-section professional report: cover page, executive summary, CVE description, root cause analysis, CVSS breakdown, exploitation steps, code explanation, proof checklist, mitigation, timeline, references, disclaimer |
Quick Start
1. Build & Start the Lab
cd CVE-2021-3156-Project/lab/
# Build the vulnerable image (downloads Ubuntu 20.04, pins sudo 1.8.31)
docker compose build
# Start both containers
docker compose up -d
# Confirm containers are running
docker compose ps
Expected:
NAME STATUS
baron_samedit_target running
baron_samedit_patched running
2. Enter the Vulnerable Container
docker exec -it baron_samedit_target bash
3. Confirm Vulnerability Conditions
# Inside the container as labuser
whoami # Expected: labuser
id # Expected: uid=1000(labuser)...
sudo --version # Expected: Sudo version 1.8.31
sudo -l # Expected: Sorry, user labuser may not run sudo...
sudoedit -s '\' 2>&1 # Expected: NOT "usage:" → VULNERABLE
4. Copy and Run the Exploit
# From host machine
docker cp exploit/exploit.py baron_samedit_target:/home/labuser/
# Inside container
python3 exploit.py --check-only # verify all prerequisites pass
python3 exploit.py --safe-mode # canary only, no exploitation
python3 exploit.py --cmd "id" # LPE → show root identity
python3 exploit.py --cmd "whoami /all" --output /tmp/proof.txt
5. Capture Evidence
# Inside container — before exploit
~/evidence_helper.sh > /tmp/before.txt
# After exploit
~/evidence_helper.sh > /tmp/after.txt
# Copy to host
docker cp baron_samedit_target:/tmp/before.txt proof/terminal_logs_before.txt
docker cp baron_samedit_target:/tmp/after.txt proof/terminal_logs_after.txt
How the Exploit Works
Step 1: Run 'sudoedit -s <crafted_argument>'
↓
Step 2: sudo calls set_cmnd() to parse arguments in shell mode
↓
Step 3: set_cmnd() COUNTS bytes for the cmnd_args buffer (correct size)
↓
Step 4: set_cmnd() COPIES bytes — but reads 1 byte past the null
terminator of any argument ending with '\'
↓
Step 5: Off-by-one overflow writes 1 unexpected byte beyond cmnd_args
↓
Step 6: Heap grooming (environment variable layout manipulation) ensures
a valuable sudo struct sits adjacent to the overflowed buffer
↓
Step 7: The overflow byte corrupts a pointer in the adjacent struct
↓
Step 8: sudo follows the corrupted pointer → executes attacker-controlled
command (via SUDO_EDITOR) with root privileges
↓
Result: uid=0(root) — from a user with ZERO sudo permissions
The Root Cause in One Line
size_calculation("A\") = 2 bytes ≠ copy("A\") = writes 3 bytes → overflow
Vulnerability Canary Test
The safest way to confirm CVE-2021-3156 is present — no exploitation required:
sudoedit -s '\' 2>&1; echo "Exit: $?"
exploit.py Usage
Usage: python3 exploit.py [OPTIONS]
Modes (mutually exclusive):
--check-only Run all pre-checks only — no exploitation
--safe-mode Run canary test only — confirm vulnerability
--cmd COMMAND Execute COMMAND as root after successful LPE
Options:
--verbose, -v Show detailed heap/system debug output
--output, -o FILE Save all output to FILE
--no-colour Disable ANSI colour codes (for log files)
--help Show this help message
Examples:
python3 exploit.py --check-only
python3 exploit.py --safe-mode
python3 exploit.py --cmd "id"
python3 exploit.py --cmd "cat /etc/shadow" --output proof/root_output.txt
python3 exploit.py --cmd "whoami" --verbose
Lab Reset & Snapshot
Quick Reset (keep container, clear temp files)
docker exec baron_samedit_target bash -c "rm -f /tmp/*.txt /tmp/exploit* /home/labuser/exploit.py"
Save a Snapshot
docker commit baron_samedit_target baron-samedit:clean-state
echo "[+] Snapshot saved as baron-samedit:clean-state"
Restore Snapshot
docker compose down
docker run -it --name baron_samedit_target baron-samedit:clean-state bash
Full Reset (rebuild from scratch)
docker compose down -v
docker compose up -d --build
Patched vs Vulnerable Comparison
To test on patched container:
docker exec -it baron_samedit_patched bash
# Then repeat the canary test — should output "invalid argument"
References
Ethical Notice
┌─────────────────────────────────────────────────────────────────┐
│ This project was created for EDUCATIONAL PURPOSES ONLY as │
│ part of the ITSOLERA Cybersecurity Red Team Internship 2026. │
│ │
│ ✅ DO: Use against the isolated Docker lab only │
│ ✅ DO: Study the vulnerability to understand heap exploits │
│ ✅ DO: Contribute findings to the team report │
│ │
│ ❌ DON'T: Run against any real system, VM, or cloud instance │
│ ❌ DON'T: Share outside the internship programme │
│ ❌ DON'T: Use for any unauthorised access │
└─────────────────────────────────────────────────────────────────┘
ITSOLERA Cybersecurity Department — Red Team Internship, Summer 2026
shams-ul-mehmood/cve-2021-3156-project
