Comments (2)
CVE-2021-3156 requires libc 2.26+ as shown over at https://github.com/worawit/CVE-2021-3156/blob/main/exploit_nss.py#L112
glibc 2.26+ is required only for the tcache technique.
While blasty's exploit probably won't work with Ubuntu's glibc 2.23-0ubuntu3 this is due to lacking offsets rather than due to the version of glibc.
The situation is a little more complex than simply checking for glibc 2.26+. There are several different exploitation techniques for this vulnerability and many exploits.
worowit's exploit you've linked to uses the tcache technique which requires glibc 2.26+. That is a different exploit to the recommended exploit (by blasty) which uses the userspec overwrite technique and does not require a version of glibc with support for tcache.
worowit also has a userspec variant which does not require tcache:
Similarly, the sudo_baron_samedit
Metasploit module for Baron Samedit has been tested and is known to work with various versions of glibc before 2.26 (it wraps worawit's exploits):
It makes sense to have matches for both exploits. linux-exploit-suggester will recommended both blasty's and worawit's exploits:
As such, this should never have been recommended.
It is significantly easier to check only the version of sudo, as version matching is somewhat complicated by distros using their own versioning scheme and back porting. The vulnerability exists within sudo and there is some leeway in the glibc version. Sometimes the offsets remain the same between versions or require only minimal adjustment to get working. For example, the offsets for Ubuntu 18.04.5 (Bionic Beaver) - sudo 1.8.21, libc-2.27
and Ubuntu 20.04.1 (Focal Fossa) - sudo 1.8.31, libc-2.31
are identical, despite the minor version of sudo having incremented by 10 revisions and the minor version of libc having incremented by 4 revisions). It is significantly more useful to have these exploits recommended than not recommended at all, even with the risk of false positives.
Also, the exploit repositories contain brute-force scripts which can be used to exploit systems for which the version of glibc has not been previously tested/confirmed as usable.
from linux-exploit-suggester.
While blasty's exploit probably won't work with Ubuntu's glibc 2.23-0ubuntu3 this is due to lacking offsets rather than due to the version of glibc.
It is significantly easier to check only the version of sudo, as version matching is somewhat complicated by distros using their own versioning scheme and back porting.
Both are extremely valid points, and that was a very well-written response overall!
As such, this seems to be user error far more than script error, and I shall be marking this as closed!
from linux-exploit-suggester.
Related Issues (20)
- My OS is up to date, why I still get the CVE exposure report? HOT 4
- Please update the script
- Broken URLs to exploitdb binsploits repo
- 在centos4.9上无法执行,显示Script needs Bash in version 4.0 or newer. Aborting
- [Suggestion] Alternative exploit for CVE-2017-1000112 HOT 1
- [Suggestion] Alternative exploit for CVE-2017-7308 HOT 1
- CONFIG_CC_STACKPROTECTOR deprecated in kernel 4.16 HOT 1
- Incorrect details for double-fdput (CVE-2016-4557) HOT 1
- Package version detection HOT 2
- bash compatibility HOT 2
- cannot create temp file for here-document: No such file or directory HOT 6
- Inventory notification HOT 1
- cat: write error: Broken pipe
- Aborts with `Both 'src-url' and 'exploit-db' entries are empty for '\e[1;32m[CVE-2019-15666]\e[0m XFRM_UAF' exploit - fix that. Aborting.` HOT 4
- Exploit Dirty cow 2 has been moved permanently. HOT 1
- Allow JSON output for automation integration
- Typo: memodipper instead of mempodipper HOT 2
- Please Help Me HOT 3
- How To Add Exploit (CVE-2023-0386 OverlayFS) HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from linux-exploit-suggester.