Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

github.com

Post reply on HN
Print view View original

1–10 of 43 posts

Re: Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

#2

Post by tyingq »

I was initially confused if this was just WSL as "WSL and Linux" could be interpreted that way.

It's not just WSL. It would appear to be sudo, wherever it runs. I didn't see anything Linux specific about the CVE, other than maybe there are platforms that are better about heap-based buffer overflows.

Re: Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

#3

Post by raimue »

I don't know much about WSL, but the instructions for this do not look right. Isn't WSL usually just a Linux distribution, so you should also use the package manager?

If you just run ./configure && make && sudo make install, sudo will be installed to /usr/local as prefix. Doesn't this mean the unpatched binary at /usr/bin/sudoedit will still be accessible?

Re: Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

#4

Post by bonyt »

macOS doesn't have sudoedit, but you can make a symlink to it, as sudo is effectively a multi-call binary:

   ln -s `which sudo` sudoedit
and then call it:

   ./sudoedit
So don't take the lack of a `sudoedit` command as evidence that a system isn't vulnerable. I don't know if the sudo included with macOS has been exploited though.

Re: Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

#5

Post by shrx »

raimue wrote: post #3

I don't know much about WSL, but the instructions for this do not look right. Isn't WSL usually just a Linux distribution, so you should also use the package manager? If you just run ./configure && make && sudo make install, sudo will be installed to /usr/local as prefix. Doesn't this mean the unpatched binary at /usr/bin/sudoedit will still be accessible?

Yeah the instructions are poorly written. Also, in my case (ubuntu 20.04) running `sudo apt-get --only-upgrade install sudo` does nothing, the latest version available is 1.8.31-1ubuntu1.2.

Re: Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

#6

Post by shawnz »

raimue wrote: post #3

I don't know much about WSL, but the instructions for this do not look right. Isn't WSL usually just a Linux distribution, so you should also use the package manager? If you just run ./configure && make && sudo make install, sudo will be installed to /usr/local as prefix. Doesn't this mean the unpatched binary at /usr/bin/sudoedit will still be accessible?

Right, the correct solution here for WSL would also be to run "apt-get upgrade" or whatever your distro uses.

Re: Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

#7

Post by comfydragon »

shrx wrote: post #5
raimue wrote: post #3

I don't know much about WSL, but the instructions for this do not look right. Isn't WSL usually just a Linux distribution, so you should also use the package manager? If you just run ./configure && make && sudo make install, sudo will be installed to /usr/local as prefix. Doesn't this mean the unpatched binary at /usr/bin/sudoedit will still be accessible?

Yeah the instructions are poorly written. Also, in my case (ubuntu 20.04) running `sudo apt-get --only-upgrade install sudo` does nothing, the latest version available is 1.8.31-1ubuntu1.2.

That version has the patches for this CVE. https://launchpad.net/ubuntu/+source/sudo/1.8.31-1ubuntu1.2

I had basically the same comment on the first HN posts about it. Just because `sudo -V` doesn't say 1.9.5p2 doesn't mean you're still vulnerable... https://news.ycombinator.com/item?id=25920839

Re: Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

#8

Post by [deleted] »

shrx wrote: post #5
raimue wrote: post #3

I don't know much about WSL, but the instructions for this do not look right. Isn't WSL usually just a Linux distribution, so you should also use the package manager? If you just run ./configure && make && sudo make install, sudo will be installed to /usr/local as prefix. Doesn't this mean the unpatched binary at /usr/bin/sudoedit will still be accessible?

Yeah the instructions are poorly written. Also, in my case (ubuntu 20.04) running `sudo apt-get --only-upgrade install sudo` does nothing, the latest version available is 1.8.31-1ubuntu1.2.

[deleted]

Re: Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

#9

Post by [deleted] »

shrx wrote: post #5
raimue wrote: post #3

I don't know much about WSL, but the instructions for this do not look right. Isn't WSL usually just a Linux distribution, so you should also use the package manager? If you just run ./configure && make && sudo make install, sudo will be installed to /usr/local as prefix. Doesn't this mean the unpatched binary at /usr/bin/sudoedit will still be accessible?

Yeah the instructions are poorly written. Also, in my case (ubuntu 20.04) running `sudo apt-get --only-upgrade install sudo` does nothing, the latest version available is 1.8.31-1ubuntu1.2.

[deleted]

Re: Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

#10

Post by mcrump »

shawnz wrote: post #6
raimue wrote: post #3

I don't know much about WSL, but the instructions for this do not look right. Isn't WSL usually just a Linux distribution, so you should also use the package manager? If you just run ./configure && make && sudo make install, sudo will be installed to /usr/local as prefix. Doesn't this mean the unpatched binary at /usr/bin/sudoedit will still be accessible?

Right, the correct solution here for WSL would also be to run "apt-get upgrade" or whatever your distro uses.

I noticed that I had a typo in my command.

-- original comment

You can run it but it doesn't find anything. https://www.youtube.com/watch?v=iRIXXUNkgAM&t=1244s

Post reply on HN