Developers: your moment has come at last to humble your local system administrator for wearing those "I read your emails" t-shirts. This is as day zero as day zero gets. Red Hat and Debian published their security announcements just two hours ago at the exact same moment this was posted on Hacker News. It would have been more responsible to keep something this bad under wraps a bit longer. Because all the people who still use things like cpanel virtual hosting are at risk.
Heap-based buffer overflow in Sudo
31–40 of 328 posts
Re: Heap-based buffer overflow in Sudo
#32In case no one gets the pun: https://en.wikipedia.org/wiki/Baron_Samedi
also the very final boss character in goldeneye 007 for n64
Re: Heap-based buffer overflow in Sudo
#33Earlier quoted context omitted.
People use the tools they have available and understand. Rust, at the time this bug was introduced into sudo, was barely a year old, and hadn't even released 0.1 yet. Also, the sarcasm in your comment really doesn't help your message.
I have been advocating against C since comp.lang.c days, no need for lessons about how to market something that the audience obviously isn't interested into paying attention. The first systems programming language that would prevented this kind of exploit was written in 1961, 10 years before C was invented.
Note, beyond all sarcasm, I adhere. At least all critical pieces like sudo must be rewritten in a safer language than C.
Re: Heap-based buffer overflow in Sudo
#34I don't find bug reports for this in either Debian or Ubuntu bug tracking systems. When do these get entered?
Re: Heap-based buffer overflow in Sudo
#35Here is a non .txt format with a great video explanation as well: https://blog.qualys.com/vulnerabilities-research/2021/01/26/...
Re: Heap-based buffer overflow in Sudo
#36Shouldn't this affect macOS?
sudoedit doesn't seem to be installed?
Not the thing saving you, as it is sudo invoked as sudoedit that permits entering the bad codepath... A simple symbolic link and you now have sudoedit.
And... macOS looks vulnerable to me
% cd ~ && ln -s /usr/bin/sudo sudoedit && ./sudoedit -s /
Password:
sudoedit: /: not a regular file
Re: Heap-based buffer overflow in Sudo
#37I don't find bug reports for this in either Debian or Ubuntu bug tracking systems. When do these get entered?
https://security-tracker.debian.org/tracker/CVE-2021-3156
Also, if you run a large Debian farm, it may be worth subscribing to debian-security-announce:
* https://lists.debian.org/debian-security-announce/
The message for this issue went out 18:05 UTC:
* https://lists.debian.org/debian-security-announce/2021/msg00...
See also the RSS feed for:
Re: Heap-based buffer overflow in Sudo
#38"rewrite sudo in Rust" in 3,2...
Or just recompile sudo with -fsanitize=address
Re: Heap-based buffer overflow in Sudo
#39Please let this be a reference to Count Zero and the loa of the matrix :(
Re: Heap-based buffer overflow in Sudo
#40Memory safety strikes again, it seems (overflow in a C string due to complex parameter parsing rules).