Decade-old bug in Linux world's sudo can be abused by any logged-in user to gain root privileges
(2021/01/26)
- Reference: 1611695548
- News link: https://www.theregister.co.uk/2021/01/26/qualys_sudo_bug/
- Source link:
Security researchers from Qualys have identified a critical heap buffer overflow vulnerability in sudo that can be exploited by rogue users to take over the host system.
Sudo is an open-source command-line utility widely used on Linux and other Unix-flavored operating systems. It is designed to give selected, trusted users administrative control when needed.
[1]
The bug (CVE-2021-3156) found by Qualys, though, allows any local user to gain root-level access on a vulnerable host in its default configuration. Qualys is disclosing its findings in a coordinated release with operating systems vendors, and has bestowed the errant code with the memorable name of the mythical mischief-maker [2]Baron Samedi .
The following versions of sudo are affected: 1.8.2 through 1.8.31p2 and 1.9.0 through 1.9.5p1. Qualys developed exploits for several Linux distributions, including Ubuntu 20.04 (Sudo 1.8.31), Debian 10 (Sudo 1.8.27), and Fedora 33 (Sudo 1.9.2), and the security biz believes other distributions are vulnerable, too.
[3]
[4]Ubuntu and [5]Red Hat have already published patches, and your distro may have as well, so get to it.
Oh ****... Sudo has a 'make anyone root' bug that needs to be patched – if you're unlucky enough to enable pwfeedback [6]READ MORE
In their [7]write-up , Qualys researchers explain, " set_cmnd() is vulnerable to a heap-based buffer overflow, because the out-of-bounds characters that are copied to the 'user_args' buffer were not included in its size."
The report also documents how they were able to defeat the ASLR defense mechanism intended to thwart these sorts of exploits.
In a statement, Mehul Revankar, VP of product management and engineering at Qualys, said the vulnerability "is perhaps the most significant sudo vulnerability in recent memory (both in terms of scope and impact) and has been hiding in plain sight for nearly 10 years."
The bug was introduced in July 2011 ( [8]commit 8255ed69 ) and has persisted unfixed until now.
[9]
Noting that sudo is nearly ubiquitous and is available by default in most Linux systems, Revankar said there are likely to be millions of vulnerable systems that need to be patched. ®
Get our [10]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YBCfBdsq5d3E0FRKyHu@1wAAANQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://en.wikipedia.org/w/index.php?title=Baron_Samedi&oldid=1002840797
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YBCfBdsq5d3E0FRKyHu@1wAAANQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://ubuntu.com/security/notices/USN-4705-1
[5] https://access.redhat.com/errata/RHSA-2021:0218
[6] https://www.theregister.com/2020/02/05/sudo_bug_allows_privilege_escalation/
[7] https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
[8] https://github.com/sudo-project/sudo/commit/8255ed69
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YBCfBdsq5d3E0FRKyHu@1wAAANQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
Sudo is an open-source command-line utility widely used on Linux and other Unix-flavored operating systems. It is designed to give selected, trusted users administrative control when needed.
[1]
The bug (CVE-2021-3156) found by Qualys, though, allows any local user to gain root-level access on a vulnerable host in its default configuration. Qualys is disclosing its findings in a coordinated release with operating systems vendors, and has bestowed the errant code with the memorable name of the mythical mischief-maker [2]Baron Samedi .
The following versions of sudo are affected: 1.8.2 through 1.8.31p2 and 1.9.0 through 1.9.5p1. Qualys developed exploits for several Linux distributions, including Ubuntu 20.04 (Sudo 1.8.31), Debian 10 (Sudo 1.8.27), and Fedora 33 (Sudo 1.9.2), and the security biz believes other distributions are vulnerable, too.
[3]
[4]Ubuntu and [5]Red Hat have already published patches, and your distro may have as well, so get to it.
Oh ****... Sudo has a 'make anyone root' bug that needs to be patched – if you're unlucky enough to enable pwfeedback [6]READ MORE
In their [7]write-up , Qualys researchers explain, " set_cmnd() is vulnerable to a heap-based buffer overflow, because the out-of-bounds characters that are copied to the 'user_args' buffer were not included in its size."
The report also documents how they were able to defeat the ASLR defense mechanism intended to thwart these sorts of exploits.
In a statement, Mehul Revankar, VP of product management and engineering at Qualys, said the vulnerability "is perhaps the most significant sudo vulnerability in recent memory (both in terms of scope and impact) and has been hiding in plain sight for nearly 10 years."
The bug was introduced in July 2011 ( [8]commit 8255ed69 ) and has persisted unfixed until now.
[9]
Noting that sudo is nearly ubiquitous and is available by default in most Linux systems, Revankar said there are likely to be millions of vulnerable systems that need to be patched. ®
Get our [10]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YBCfBdsq5d3E0FRKyHu@1wAAANQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://en.wikipedia.org/w/index.php?title=Baron_Samedi&oldid=1002840797
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YBCfBdsq5d3E0FRKyHu@1wAAANQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://ubuntu.com/security/notices/USN-4705-1
[5] https://access.redhat.com/errata/RHSA-2021:0218
[6] https://www.theregister.com/2020/02/05/sudo_bug_allows_privilege_escalation/
[7] https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
[8] https://github.com/sudo-project/sudo/commit/8255ed69
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YBCfBdsq5d3E0FRKyHu@1wAAANQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
Re: How is this possible?
trist
Hmmm so even the unintended consequences of general C library and/or system calls that are meant to be generic and all useful? I think that this shows how simple it is.
Re: How is this possible?
cantankerous swineherd
not engineering but blacksmithing.
Re: How is this possible?
Sam Liddicott
Stop using C, peeps!
It's too hard to get right enough everywhere, as we are seeing.
Re: How is this possible?
overunder
Stop using C... too true, that's why there is never any bugs in C++ applications by Microsoft or Adobe. Well, it's either that or that they have the utmost highest standards.
Fedora as far back, at least as Fedora 28
Dyspeptic Curmudgeon
Fedora 28 uses sudo -V 1.8.23
Fedora 32 uses sudo -V 1.9.2
dvd
My Mint install just got a patch.
Gary Stewart
I fairly sure Debian has put out a patch since it has shown up on my computer running Devuan.
Anonymous Coward
Can confirm, just updated to 1.8.27-1+deb10u3 on my server.
"has been hiding in plain sight for nearly 10 years"
Pascal Monett
And someone at the NSA is seriously pissed right now.
RHEL/CentOS7
Dazed and Confused
I guess the update is available for RHEL7 but CentOS7 isn't showing it yet.
How is this possible?
Surely sudo is one of the more closely studied applications, since it is designed for privilege escalation. If it had a buffer overflow for years despite all those "many eyes" there's no hope for less closely studied or closed source stuff to be secure.