Baron Samedit — the sudo heap overflow, end to end

02 Technical BreakdownFor engineers

CVE-2021-3156 is a heap-based buffer overflow in sudo's policy plugin, in the set_cmnd() function of plugins/sudoers/sudoers.c. It was introduced in July 2011 (commit 8255ed69), sat quietly in the codebase for nearly a decade, and was disclosed by Qualys on 2021-01-26 alongside the fix in sudo 1.9.5p2. Every legacy build from 1.8.2 through 1.8.31p2 and every stable build from 1.9.0 through 1.9.5p1 is vulnerable in its default configuration. NVD scores it 7.8 (High).

Mechanically: when sudo executes a command in shell mode (-s or -i), parse_args() escapes all metacharacters in the arguments with backslashes; later, set_cmnd() un-escapes them into a heap buffer, user_args, sized to the concatenated arguments. If an argument ends in a single backslash, the unescape loop copies that argument's null terminator and then keeps reading and copying out-of-bounds heap data into user_args — a classic heap overflow. Under a normal sudo invocation this state is unreachable, because the escaping pass guarantees no argument can end in a lone backslash. Neat, right? Well — the loophole is the sudoedit symlink: invoking sudo under that name sets MODE_EDIT without pruning MODE_SHELL from the valid flags, so sudoedit -s bypasses the escaping pass yet still reaches the vulnerable unescape code. Oops.

Exploitation is unusually reliable for a memory-corruption bug. The attacker controls the size of the overflowed buffer (via argument length) and the size and content of the overflow itself — environment variables sit directly after the arguments and get copied in, null bytes and all. Qualys developed multiple independent exploit variants and got full root on Ubuntu 20.04 (sudo 1.8.31), Debian 10 (1.8.27), and Fedora 33 (1.9.2); macOS, AIX, and Solaris were also reported vulnerable, though Qualys didn't independently verify those. The only precondition is local code execution as any user — the overflow fires inside the setuid-root binary before authentication and before the sudoers check, so even the nobody account can trigger it. Yikes.

The fix is a boundary correction in the unescape loop: a backslash at the end of a string is no longer treated as an escape character, so the copy can never run past the end of the buffer. Patched builds reject the sudoedit -s '\' payload with a usage error instead of corrupting the heap. No configuration change is required, and there's no workaround short of patching.