Notes regarding CVE-2021-3156: Heap-Based Buffer Overflow in Sudo
Home Page: http://twitch.tv/mbcrump
License: MIT License
I make YouTube videos and live stream topics regarding console hacking on YouTube.
WSL2 Ubuntu 20.04.1 LTS, sudo version 1.8.31
Checking whether I'm affected doesn't return any of the example responses for affected or unaffected.
sudoedit -s '\' `perl -e 'print "A" x 65536'`
malloc(): corrupted top size
[1] 22361 abort sudoedit -s '\' `perl -e 'print "A" x 65536'`
And installing the new sudo version works but with errors:
cd ~/
wget https://www.sudo.ws/dist/sudo-1.9.5p2.tar.gz
tar xzvf sudo-1.9.5p2.tar.gz
cd sudo-1.9.5p2
./configure
make && sudo make install
rm sudo-1.9.5p2.tar.gz
rm ./sudo-1.9.5p2 -rf
make[1]: Leaving directory '/home/bverst/sudo-1.9.5p2/src'
make[1]: Entering directory '/home/bverst/sudo-1.9.5p2/include'
/bin/bash ../scripts/mkinstalldirs /usr/local/include
/bin/bash ../install-sh -c -o 0 -g 0 -m 0644 ./sudo_plugin.h /usr/local/include
make[1]: Leaving directory '/home/bverst/sudo-1.9.5p2/include'
make[1]: Entering directory '/home/bverst/sudo-1.9.5p2/doc'
/bin/bash ../scripts/mkinstalldirs /usr/local/share/doc/sudo \
/usr/local/man/man1 /usr/local/man/man5 /usr/local/man/man8
mkdir /usr/local/man
mkdir: cannot create directory ‘/usr/local/man’: File exists
mkdir /usr/local/man/man1
mkdir: cannot create directory ‘/usr/local/man/man1’: No such file or directory
mkdir /usr/local/man
mkdir: cannot create directory ‘/usr/local/man’: File exists
mkdir /usr/local/man/man5
mkdir: cannot create directory ‘/usr/local/man/man5’: No such file or directory
mkdir /usr/local/man
mkdir: cannot create directory ‘/usr/local/man’: File exists
mkdir /usr/local/man/man8
mkdir: cannot create directory ‘/usr/local/man/man8’: No such file or directory
make[1]: *** [Makefile:339: install-dirs] Error 1
make[1]: Leaving directory '/home/bverst/sudo-1.9.5p2/doc'
make: *** [Makefile:190: install] Error 2
However new sudo was installed
source ~/.zshrc
sudo --version
Sudo version 1.9.5p2
Sudoers policy plugin version 1.9.5p2
Sudoers file grammar version 48
Sudoers I/O plugin version 1.9.5p2
Sudoers audit plugin version 1.9.5p2
Any thoughts on how to get the man pages installed correctly?
The WSL instructions are a bit misleading as one doesn't have to download the sources and compile if they are using a standard distro. In the case of Ubuntu there is just a simple update needed. All I had to do was run sudo apt update && sudo apt --only-upgrade install sudo to get 1.8.31-1ubuntu1.2 which fixes the CVE in question. https://launchpad.net/ubuntu/+source/sudo/1.8.31-1ubuntu1.2 Those running their own custom WSL distro might still have to compile from source.
If I where to make a PR with instructions for Ubuntu on WSL, would you accept them?
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.