11 ms·

Heap-based buffer overflow in Sudo

400 points by ptype 6y ago

eqvinox 6y ago
‹insert "oh shit" here›
megous 6y ago
One of those programs that you should not install unless you really need them.
- wahern 6y ago
  Not sure if you were being sarcastic, but OpenBSD removed sudo several years ago. The native tool is doas: https://man.openbsd.org/doas https://man.openbsd.org/doas sudo just became too complex, what with the feature creep demanded by corporate Linux users.
  - megous 6y ago
    Not sarcastic. SUID root binaries are a prime target for hackers, and even I've used them to gain local privilege escalation in the past. For example authors of VEGA5000 payment terminal made pppd used for GPRS internet connection have a suid root permissions, and pppd can be used to execute other programs just based on the command line arguments. So that was that. sudo looks quite complicated, just by looking at what it has to parse and validate (sudoers file). I'd rather not have it on the server, and just use custom purpose made static built suid binaries for necessary minimal purposes of privilege granting. It's not even installed by default on some popular Linux distros. Of course I realize that it's very ubiquitous, regardless of this. And it's probably fine to use on your workstation. But leaving it unattended on some server feels a bit dreadful.
- vbezhenar 6y ago
  It is installed in Debian-minimal by default. I guess it's the same with many other distros. I don't understand why "minimal" installs sudo.
zaltekk 6y ago
> introduced in July 2011 (commit 8255ed69), and affects all legacy versions from 1.8.2 to 1.8.31p2 and all stable versions from 1.9.0 to 1.9.5p1, in their default configuration. It looks like this is pretty far reaching. All of my boxes were vulnerable to this before updating today.
zaltekk 6y ago
> introduced in July 2011 (commit 8255ed69), and affects all legacy versions from 1.8.2 to 1.8.31p2 and all stable versions from 1.9.0 to 1.9.5p1, in their default configuration. It looks like this is pretty far reaching. All of my boxes were vulnerable to this before updating today.
nahuel0x 6y ago
"rewrite sudo in Rust" in 3,2...
- pjmlp 6y ago
  Why? After all it is obvious code reviewers are enough to catch any typical C memory corruption error.
  - eqvinox 6y ago
    People use the tools they have available and understand. Rust, at the time this bug was introduced into sudo, was barely a year old, and hadn't even released 0.1 yet. Also, the sarcasm in your comment really doesn't help your message.
    - pjmlp 6y ago
      I have been advocating against C since comp.lang.c days, no need for lessons about how to market something that the audience obviously isn't interested into paying attention. The first systems programming language that would prevented this kind of exploit was written in 1961, 10 years before C was invented.
      - eqvinox 6y ago
        Neither of these is an excuse for the condescending, snarky tone. [Ed.: Actually, the tone is probably a factor in the audience not being interested.] [Ed. 2: https://news.ycombinator.com/item?id=21490714 https://news.ycombinator.com/item?id=21490714 ]
        pjmlp 6y ago
        As usual in everything tech related, it depends.
      - nahuel0x 6y ago
        Note, beyond all sarcasm, I adhere. At least all critical pieces like sudo must be rewritten in a safer language than C.
netsec_burn 6y ago
Shouldn't this affect macOS?
- ArchOversight 6y ago
  sudoedit doesn't seem to be installed?
  - brohee 6y ago
    Not the thing saving you, as it is sudo invoked as sudoedit that permits entering the bad codepath... A simple symbolic link and you now have sudoedit. And... macOS looks vulnerable to me % cd ~ && ln -s /usr/bin/sudo sudoedit && ./sudoedit -s / Password: sudoedit: /: not a regular file As per the advisory it looks vulnerable (sudoedit: and not usage:)
fattire 6y ago
sudo built with ASLR doesn't make a difference? NM: - we can defeat ASLR by partially overwriting the function pointer getenv_fn (which points to the function sudoers_hook_getenv() in the shared library sudoers.so); and luckily, the beginning of sudoers.so contains a call to execve() (or execv()):
- saagarjha 6y ago
  This is not sudo being build with ASLR, but library ASLR.
2bitencryption 6y ago
I'm curious, is this one implementation of sudo really used everywhere? I was under the impression that different Linux userspaces sometimes implement these common commands differently. Like "ls" sometimes actually being aliased to a bash script, or maybe BSD having one implementation and Ubuntu another. Is that not the case? Is "sudo" not maintained by an entity like gnu, bsd, etc? edit - in other words, I always assumed "sudo" was a highly-dependent system-level tool, not just some useful helper binary that is maintained by one independent person.
- sigio 6y ago
  Nope... sudo is just this sudo in 99.99% of the cases. There are some alternatives, such as *bsd's doas, and others, but all but doas and su are so non-popular and outdated that I would not recommend using them, as they probably have way more security issues.
  - wahern 6y ago
    doas is just OpenBSD. You can install doas from ports on NetBSD or FreeBSD, just like you can install doas on Linux. OpenBSD dropped sudo from the base OS several years ago. sudo just became too complex, tailored to the feature creep demanded and required (PAM, ugh) by Linux users.
    - turminal 6y ago
      Briefly going through their website (sudo.ws) I am seriously wondering why anyone would want to put some of those features in a privilege management tool.
      - wahern 6y ago
        Todd Miller is a sharp developer and core OpenBSD contributor. I can only imagine the deluge of requests and pressure he faces to expand sudo. There's no end to the crazy stuff corporations demand, especially when it comes to integration--audit, logging, ldap, etc.
cab404 6y ago
Never knew sudo had a site (https://sudo.ws https://sudo.ws). Never knew it had a mascot, if you could call it so... I will never unsee it. Nightmare fuel at it's finest.
- bitwize 6y ago
  Oh my God, it's a reference to the "sudo make me a sandwich" XKCD on top of it all.
  - rootsudo 6y ago
    That's the best, I didn't/couldn't believe it, but it's true. This made my day. God it is scary.
- BenFeldman1930 6y ago
  Every time you run it, it is eating a part of your soul. Nom nom nom
- yread 6y ago
  Hmm the year is wrong on the timestamps. Attention to detail is important in C programmers working on security critical software...
jzer0cool 6y ago
Any list somewhere which provides a list of affected OSs or at least how to check?
- wtfishackernews 6y ago
  sudo --version anything below version 1.9.5p2 is affected
  - comfydragon 6y ago
    Unless the patches have been backported, as is the case for Ubuntu 18.04, in which case it may not need to be 1.9.5p2. https://launchpad.net/ubuntu/+source/sudo/1.8.21p2-3ubuntu1.4 https://launchpad.net/ubuntu/+source/sudo/1.8.21p2-3ubuntu1....
  - jzer0cool 6y ago
    how to patch (e.g. ubuntu)? or requires compiling from source? EDIT: see above post provided by comfydragon
- kbaker 6y ago
  sudo unattended-upgrade --dry-run Looks like I get a new sudo!
krapp 6y ago
In case no one gets the pun: https://en.wikipedia.org/wiki/Baron_Samedi https://en.wikipedia.org/wiki/Baron_Samedi
- mrlonglong 6y ago
  Good memories playing with Voodoo mode on x86.
- rkachowski 6y ago
  also the very final boss character in goldeneye 007 for n64
ncmncm 6y ago
I don't find bug reports for this in either Debian or Ubuntu bug tracking systems. When do these get entered?
- ximm 6y ago
  https://security-tracker.debian.org/tracker/CVE-2021-3156 https://security-tracker.debian.org/tracker/CVE-2021-3156
  - throw0101a 6y ago
    Also, if you run a large Debian farm, it may be worth subscribing to debian-security-announce: * https://lists.debian.org/debian-security-announce/ https://lists.debian.org/debian-security-announce/ The message for this issue went out 18:05 UTC: * https://lists.debian.org/debian-security-announce/2021/msg00020.html https://lists.debian.org/debian-security-announce/2021/msg00... See also the RSS feed for: * https://www.debian.org/security/ https://www.debian.org/security/
- bboozzoo 6y ago
  There's a corresponding Ubuntu security notice: https://ubuntu.com/security/notices/USN-4705-1 https://ubuntu.com/security/notices/USN-4705-1
jart 6y ago
Developers: your moment has come at last to humble your local system administrator for wearing those "I read your emails" t-shirts. This is as day zero as day zero gets. Red Hat and Debian published their security announcements just two hours ago at the exact same moment this was posted on Hacker News. It would have been more responsible to keep something this bad under wraps a bit longer. Because all the people who still use things like cpanel virtual hosting are at risk.
- stevekemp 6y ago
  cpanel is a web-based thing though, isn't it? You'd need shell access to the host to execute `sudo` and attempt to exploit it.
  - jart 6y ago
    CPanel is a web gui for managing Linux systems. It's mainly used to configure and resell apache virtual hosts. Shell accounts is one of the things it manages. These companies normally have like hundreds of customers per server since they charge ~$1/month for hosting. So anyone who pays one dollar a month extra for shell access can compromise a whole lot of people. I tried tweeting at these virtual hosting providers to bring the vulnerability to their attention, but no one's responded.
thricegr8 6y ago
Here is a non .txt format with a great video explanation as well: https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit https://blog.qualys.com/vulnerabilities-research/2021/01/26/...
bpiche 6y ago
Please let this be a reference to Count Zero and the loa of the matrix :(
MayeulC 6y ago
Memory safety strikes again, it seems (overflow in a C string due to complex parameter parsing rules).
- ddevault 6y ago
  No, complexity strikes again. I haven't used sudo in years, preferring to use doas now. Its essential code is less than 500 lines and it does everything I've ever used sudo for, and that includes much more than `sudo <runupdates>`. $ man doas | wc -l 58 $ man doas.conf | wc -l 101 $ man sudo | wc -l 741 $ man sudoers | wc -l 3254 And a bonus: $ man sudoers | grep -C1 despair The sudoers file grammar will be described below in Extended Backus-Naur Form (EBNF). Don't despair if you are unfamiliar with EBNF; it is fairly simple, and the definitions below are annotated. That only accounts for a small subset of sudo's complexity. It's easily 100x more complex than it needs to be to solve this problem. Now compare the two CVE lists: http://ftp.netbsd.org/pub/pkgsrc/current/pkgsrc/security/doas/README.html http://ftp.netbsd.org/pub/pkgsrc/current/pkgsrc/security/doa... http://ftp.netbsd.org/pub/pkgsrc/current/pkgsrc/security/sudo/README.html http://ftp.netbsd.org/pub/pkgsrc/current/pkgsrc/security/sud... My reaction to this vulnerability was mild amusement, then later wondering if I should go discredit the inevitable Rust brigade. We don't have to rewrite everything in Rust to get better security. We just have to use simpler tools.
  - comex 6y ago
    But if sudo were written in Rust, it could have the same level of complexity and not be vulnerable. Yes, it would still be vulnerable to logic errors, like the last famous sudo bug where you pass -1 as the UID. But it wouldn't be vulnerable to this. (And this isn't the first memory safety bug to be found in sudo.) Yes, sudo's complexity is useless for 99.99% of its users. But wouldn't it be nice if the result were merely a gross feeling rather than a security hole?
    - ddevault 6y ago
      >But if sudo were written in Rust, it could have the same level of complexity and not be vulnerable. This is not true. Complexity breeds bugs, including security bugs, and memory safety doesn't change that. Your example is a good one - here's another: doas once failed to limit the environment variables which are passed to the child process, which could be used to nefariously influence the program running (e.g. with LD_PRELOAD). How would Rust prevent that oversight? It wouldn't. A simpler program will generally be more secure than a complicated one, no matter what language either is written in. Furthermore, rewriting an established program from one language to another will always introduce more bugs than it fixes, and more severely the more complex the program is. The single best way to improve security is to reduce the attack surface, and the single best way to do that is to reduce the complexity of your system.
nickweb 6y ago
Is it normal for a security issue of this magnitude to have a 12 day notification period for everyone? That seems... short.
- jwilk 6y ago
  Yes. This was coordinated on the distros mailing list, which has maximum embargo period of 14 days, with periods shorter than 7 days preferable: https://oss-security.openwall.org/wiki/mailing-lists/distros#list-policy-and-instructions-for-reporters https://oss-security.openwall.org/wiki/mailing-lists/distros...
  - cpncrunch 6y ago
    Still no update for Centos 8, so I'm not sure that worked too well.
hpcl 6y ago
For years we have been indoctrinated that having a root account is evil and sudo is the proper salvation. Turns out that any user could make a root account.
deleted 6y ago
[deleted]
cjohnson318 6y ago
Any idea why did they referenced Baron Samedi? https://en.wikipedia.org/wiki/Baron_Samedi https://en.wikipedia.org/wiki/Baron_Samedi
- prutschman 6y ago
  I think it's a pun on the `sudoedit` utility used in one of the exploit paths.
  - cjohnson318 6y ago
    Oohhf.
- tekstar 6y ago
  He shows up in a William Gibson novel, in the Neuromancer series.
deleted 6y ago
[deleted]
jeffbee 6y ago
All you need to know about sudo and frankly most other pieces of the Linux userspace is that it is undertested. The commit that added this flaw to sudo claims to fix a parser bug but includes no tests. There is no reason for the author, the reviewer (if there even was such a person), or anyone else to believe that the bug existed or was fixed by this change. The pull request that supposedly fixes this CVE also includes no tests. There is no reason anyone should believe this fix is effective or complete, or that it does not introduce new defects. This is the result of people who stubbornly refuse to practice even the most basic good engineering practices, like testing and code review, while at the same time using the industry's most dangerous high-level language. As long as this type of thing continues, our tools will remain at a very low level of safety, reliability, and correctness.
- nsajko 6y ago
  I think the design of the relevant code is worse than the lack of relevant test coverage. The problem solved insecurely by the code instead seems like an obvious target for lexical and syntactic analysis (and this has been so since the sixties, I think).
  - megous 6y ago
    Yes, please at least use re2c when parsing anything more complicated in C. The result is much more readable, and integration costs are pretty low, and you still keep a lot of flexibility in how you structure your code.
- miohtama 6y ago
  Another question is who wants to maintain four decades old GNU C soup? It was written at a different time, with different best practices. In some point someone will rewrite all GNU/UNIX user land in modern Rust or similar and save the day. Until this happens these kind of incidents will happen yearly.
  - jeffbee 6y ago
    The GNU project is wall-to-wall toxic waste, but I note for the record that I don't think sudo is a GNU program and IIRC it's not even GPL.
Panino 6y ago
Qualys is great! Love their vulnerability reports. Just want to echo other praise here for doas. It's fantastic, most likely does everything you need it to do, and is secure. Install it and see for yourself!
- cpncrunch 6y ago
  I hadn't heard of Qualys until today, and am very unhappy with them. They have thrown us all under the bus by releasing details of this vulnerability before updates are available for major distros. (Still no update for Centos 8 at time of writing this, not sure about any others).
  - ilikejam 6y ago
    RedHat built the fixed sudo RPMs 5 days ago.
    - cpncrunch 6y ago
      They only released it yesterday: https://access.redhat.com/security/cve/CVE-2021-3156 https://access.redhat.com/security/cve/CVE-2021-3156 Still nothing on Centos. Perhaps just another reason to not trust Redhat.
      - cpncrunch 6y ago
        Update is finally here.
bluefox 6y ago
Every now and then we all get a glimpse, for a flash of a moment, that the house of cards has already collapsed. Too invested in our current systems to face this truth, we just update and forget about it until the next time.
- monadic3 6y ago
  This seems so silly. There are about a billion linux distros. How come none of them focus on removing functionality? Surely most lines in sudo.c are unused in the average use case. Just remove them.
tgbugs 6y ago
Yet another vindication for one of my long-standing practices. I try to avoid installing sudo at all cost on my systems because all it does is increase the attack surface. Despite this, the wisdom of the crowd is that you should never su to root, for ... reasons? Fat fingering is a thing, but if you can accidentally be in a root terminal without realizing it you have done something horribly wrong. Heck, from a certain point of view if you have someone in the habit of repeatedly typing sudo over and over again then all sudo has really done is open up every single terminal to be a gateway to the nether realm of super user privs. And in this case, more attack surface.
- tbrownaw 6y ago
  > Despite this, the wisdom of the crowd is that you should never su to root, for ... reasons? `su` takes the password of the user you're becoming, while `sudo` takes the password (or not) of the user you already are. So using `su` to become root implies that there's a root password that multiple people (well, assuming there's multiple admins on the box) know.
  - zests 6y ago
    sudo su My favorite command.
    - koprulusector 6y ago
      This is so silly that it's absolutely ludicrous, but I've never known about or used that before....... I can think of all kinds of other permutations of the command that I've used and know but not this one......
  - nsajko 6y ago
    If a system is configured as you describe, that just means that it then effectively has an additional root/admin account, except under a possibly unpredictable name. So security through obscurity, really (if the privileged user name is secret). That might make sense for some small number of setups, but instead it seems to be enormously popular, and often times it is even used in the security-defeating manner of having the "usual" user be privileged.
YetAnotherNick 6y ago
From 2017, there are at least 5 discovered security issues in sudo[1]. It seems a bit too untested for something running in root and interacting with all users. [1]: https://www.sudo.ws/ https://www.sudo.ws/
- saagarjha 6y ago
  The kernel "runs as root and interacts with all users" and has a lot more than 5 discovered security issues ;)
statquontrarian 6y ago
How does this story not have a billion upvotes? HN should introduce sticky posts just for this bug and keep it at the top of the homepage for weeks. > exploitable by any local user [...] without authentication > introduced in July 2011 [...] in their default configuration > full root privileges
- statquontrarian 6y ago
  The actual commit: https://github.com/sudo-project/sudo/commit/8255ed69 https://github.com/sudo-project/sudo/commit/8255ed69
  - sat_nam 6y ago
    Thanks for sharing this. I was looking for it on the mercurial repo at sudo.ws, but the commit didn't match. I found it here: https://www.sudo.ws/repos/sudo/rev/f666191a4e80 https://www.sudo.ws/repos/sudo/rev/f666191a4e80
tehjoker 6y ago
Are e.g. AWS, GCP, and Digital Ocean releasing emergency patches? I can't find info.
syngrog66 6y ago
this doesnt surprise me a few years ago I found a flaw in sshd. because it was impacting a Linux PAM login/auth module I was writing in C. my module should have worked. but it wasnt. because of sshd. it blew me away, given how important that server is. luckily, others must have complained too, and it ended up being fixed in a newer sshd release. but the fact that it made it into a release in the first place, impacting PAM, was scary on a not-totally-unrelated note, that was also the last C project I wrote, and since then I fell in love with Go and Rust. for systems code, for me, theres no going back. C is scary given the modern threat ecosystem and whats at stake
pengaru 6y ago
There's a reason my boxen have no sudo installed.
mbrubeck 6y ago
Just ten days ago on Hacker News, we had a C programmer claiming that “buffer over-runs are a rare class of bugs, and a class of bugs that are (at least on the heap, and often on the stack) trivial to find and fix” [1]. As a bonus, the person who wrote that turned out to have published C code containing multiple exploitable buffer overflows. [1]: https://news.ycombinator.com/item?id=25806533 https://news.ycombinator.com/item?id=25806533
- nahsjP 6y ago
  Of course not as secure as Firefox, which enables WASM by default. Or Chromium, which runs chrome-sandbox under suid.
0xbadcafebee 6y ago
I was trying to find results for PAM in CVEDB so I could go "Everybody's freaking out about sudo but PAM ain't no saint neither (https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PAM https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PAM)", but sudo's vulns seemed to really stack up last year: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=sudo https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=sudo
Uptrenda 6y ago
Wow, this looks bad. Many VPS and shared hosting providers would be directly shellable with this. Even exploits that got you onto a web server with a limited web shell = full root. Alternatively, sites that already have shells from previous script kiddies can be escalated to root too. Not that I would advocate any of this ^_^ But there are many places where local access is required and you rely on permissions to work properly. A program as important as sudo (or wide spread) is not the kind of place you want to see a vuln this severe
bolangi 6y ago
If little sudo has buffer overflows, what can we expect in the huge codebases of DBus and systemd?
mleonhard 6y ago
Is there a project to rewrite all of these Linux system utilities in forbid(unsafe) Rust?
cyounkins 6y ago
What variant of `doas` do people run as an alternative? I see Duncaen/OpenDoas, slicer69/doas, multiplexd/doas on GitHub. None seem super widely used as judged by watches/stars/forks.
- duncaen 6y ago
  I would say that the concept and implementation in C is inherently insecure. Switching to something less reviewed because there is a sudo vulnerability is not a guarantee that you are now "safer" especially if those ports are not reviewed. As far as I can say, never ever use slicer69/doas, I've found 3 critical security vulnerabilities in it, the author does not understand C or how it should work in general. Here are 3 examples if issues I found and the author used misleading commit titles to hide the issues and made excuses saying a clear buffer overflow very similar to the one found in sudo is just "potential": - https://github.com/slicer69/doas/commit/261c2164496dbebe6e3e7191db3dd7c840f6af58 https://github.com/slicer69/doas/commit/261c2164496dbebe6e3e... - https://github.com/slicer69/doas/commit/2f83222829448e5bc4c9391d607ec265a1e06531 https://github.com/slicer69/doas/commit/2f83222829448e5bc4c9... I even had to do a PR myself to fix an issue the author was not able to understand and more and more people started to use it: - https://github.com/slicer69/doas/pull/23 https://github.com/slicer69/doas/pull/23
  - cyounkins 6y ago
    Oh dear... Thank you for that info.
- anoki 6y ago
  opendoas. It's a port of OpenBSD doas by a void linux developer.
higerordermap 6y ago
At this point, can somebody recommend linux security best practices on desktop? I already have two user accounts one for important stuff and other for unimportant stuff. I prefer to use sandboxed apps, but flatpaks don't look well maintained compared to official repositories, and often unofficial. Firejail seems quite controversial due to use of UserNS? What do veterans in security recommend for sandboxing of user apps?

400 points by ptype 6y ago

eqvinox 6y ago

‹insert "oh shit" here›

megous 6y ago

One of those programs that you should not install unless you really need them.

wahern 6y ago
Not sure if you were being sarcastic, but OpenBSD removed sudo several years ago. The native tool is doas: https://man.openbsd.org/doas https://man.openbsd.org/doas sudo just became too complex, what with the feature creep demanded by corporate Linux users.
- megous 6y ago
  Not sarcastic. SUID root binaries are a prime target for hackers, and even I've used them to gain local privilege escalation in the past. For example authors of VEGA5000 payment terminal made pppd used for GPRS internet connection have a suid root permissions, and pppd can be used to execute other programs just based on the command line arguments. So that was that. sudo looks quite complicated, just by looking at what it has to parse and validate (sudoers file). I'd rather not have it on the server, and just use custom purpose made static built suid binaries for necessary minimal purposes of privilege granting. It's not even installed by default on some popular Linux distros. Of course I realize that it's very ubiquitous, regardless of this. And it's probably fine to use on your workstation. But leaving it unattended on some server feels a bit dreadful.
vbezhenar 6y ago
It is installed in Debian-minimal by default. I guess it's the same with many other distros. I don't understand why "minimal" installs sudo.

zaltekk 6y ago

> introduced in July 2011 (commit 8255ed69), and affects all legacy versions from 1.8.2 to 1.8.31p2 and all stable versions from 1.9.0 to 1.9.5p1, in their default configuration. It looks like this is pretty far reaching. All of my boxes were vulnerable to this before updating today.

zaltekk 6y ago

nahuel0x 6y ago

"rewrite sudo in Rust" in 3,2...

pjmlp 6y ago
Why? After all it is obvious code reviewers are enough to catch any typical C memory corruption error.
- eqvinox 6y ago
  People use the tools they have available and understand. Rust, at the time this bug was introduced into sudo, was barely a year old, and hadn't even released 0.1 yet. Also, the sarcasm in your comment really doesn't help your message.
  - pjmlp 6y ago
    I have been advocating against C since comp.lang.c days, no need for lessons about how to market something that the audience obviously isn't interested into paying attention. The first systems programming language that would prevented this kind of exploit was written in 1961, 10 years before C was invented.
    - eqvinox 6y ago
      Neither of these is an excuse for the condescending, snarky tone. [Ed.: Actually, the tone is probably a factor in the audience not being interested.] [Ed. 2: https://news.ycombinator.com/item?id=21490714 https://news.ycombinator.com/item?id=21490714 ]
      - pjmlp 6y ago
        As usual in everything tech related, it depends.
    - nahuel0x 6y ago
      Note, beyond all sarcasm, I adhere. At least all critical pieces like sudo must be rewritten in a safer language than C.

netsec_burn 6y ago

Shouldn't this affect macOS?

ArchOversight 6y ago
sudoedit doesn't seem to be installed?
- brohee 6y ago
  Not the thing saving you, as it is sudo invoked as sudoedit that permits entering the bad codepath... A simple symbolic link and you now have sudoedit. And... macOS looks vulnerable to me % cd ~ && ln -s /usr/bin/sudo sudoedit && ./sudoedit -s / Password: sudoedit: /: not a regular file As per the advisory it looks vulnerable (sudoedit: and not usage:)

fattire 6y ago

sudo built with ASLR doesn't make a difference? NM: - we can defeat ASLR by partially overwriting the function pointer getenv_fn (which points to the function sudoers_hook_getenv() in the shared library sudoers.so); and luckily, the beginning of sudoers.so contains a call to execve() (or execv()):

saagarjha 6y ago
This is not sudo being build with ASLR, but library ASLR.

2bitencryption 6y ago

I'm curious, is this one implementation of sudo really used everywhere? I was under the impression that different Linux userspaces sometimes implement these common commands differently. Like "ls" sometimes actually being aliased to a bash script, or maybe BSD having one implementation and Ubuntu another. Is that not the case? Is "sudo" not maintained by an entity like gnu, bsd, etc? edit - in other words, I always assumed "sudo" was a highly-dependent system-level tool, not just some useful helper binary that is maintained by one independent person.

sigio 6y ago
Nope... sudo is just this sudo in 99.99% of the cases. There are some alternatives, such as *bsd's doas, and others, but all but doas and su are so non-popular and outdated that I would not recommend using them, as they probably have way more security issues.
- wahern 6y ago
  doas is just OpenBSD. You can install doas from ports on NetBSD or FreeBSD, just like you can install doas on Linux. OpenBSD dropped sudo from the base OS several years ago. sudo just became too complex, tailored to the feature creep demanded and required (PAM, ugh) by Linux users.
  - turminal 6y ago
    Briefly going through their website (sudo.ws) I am seriously wondering why anyone would want to put some of those features in a privilege management tool.
    - wahern 6y ago
      Todd Miller is a sharp developer and core OpenBSD contributor. I can only imagine the deluge of requests and pressure he faces to expand sudo. There's no end to the crazy stuff corporations demand, especially when it comes to integration--audit, logging, ldap, etc.

cab404 6y ago

Never knew sudo had a site (https://sudo.ws https://sudo.ws). Never knew it had a mascot, if you could call it so... I will never unsee it. Nightmare fuel at it's finest.

bitwize 6y ago
Oh my God, it's a reference to the "sudo make me a sandwich" XKCD on top of it all.
- rootsudo 6y ago
  That's the best, I didn't/couldn't believe it, but it's true. This made my day. God it is scary.
BenFeldman1930 6y ago
Every time you run it, it is eating a part of your soul. Nom nom nom
yread 6y ago
Hmm the year is wrong on the timestamps. Attention to detail is important in C programmers working on security critical software...

jzer0cool 6y ago

Any list somewhere which provides a list of affected OSs or at least how to check?

wtfishackernews 6y ago
sudo --version anything below version 1.9.5p2 is affected
- comfydragon 6y ago
  Unless the patches have been backported, as is the case for Ubuntu 18.04, in which case it may not need to be 1.9.5p2. https://launchpad.net/ubuntu/+source/sudo/1.8.21p2-3ubuntu1.4 https://launchpad.net/ubuntu/+source/sudo/1.8.21p2-3ubuntu1....
- jzer0cool 6y ago
  how to patch (e.g. ubuntu)? or requires compiling from source? EDIT: see above post provided by comfydragon
kbaker 6y ago
sudo unattended-upgrade --dry-run Looks like I get a new sudo!

krapp 6y ago

In case no one gets the pun: https://en.wikipedia.org/wiki/Baron_Samedi https://en.wikipedia.org/wiki/Baron_Samedi

mrlonglong 6y ago
Good memories playing with Voodoo mode on x86.
rkachowski 6y ago
also the very final boss character in goldeneye 007 for n64

ncmncm 6y ago

I don't find bug reports for this in either Debian or Ubuntu bug tracking systems. When do these get entered?

ximm 6y ago
https://security-tracker.debian.org/tracker/CVE-2021-3156 https://security-tracker.debian.org/tracker/CVE-2021-3156
- throw0101a 6y ago
  Also, if you run a large Debian farm, it may be worth subscribing to debian-security-announce: * https://lists.debian.org/debian-security-announce/ https://lists.debian.org/debian-security-announce/ The message for this issue went out 18:05 UTC: * https://lists.debian.org/debian-security-announce/2021/msg00020.html https://lists.debian.org/debian-security-announce/2021/msg00... See also the RSS feed for: * https://www.debian.org/security/ https://www.debian.org/security/
bboozzoo 6y ago
There's a corresponding Ubuntu security notice: https://ubuntu.com/security/notices/USN-4705-1 https://ubuntu.com/security/notices/USN-4705-1

jart 6y ago

Developers: your moment has come at last to humble your local system administrator for wearing those "I read your emails" t-shirts. This is as day zero as day zero gets. Red Hat and Debian published their security announcements just two hours ago at the exact same moment this was posted on Hacker News. It would have been more responsible to keep something this bad under wraps a bit longer. Because all the people who still use things like cpanel virtual hosting are at risk.

stevekemp 6y ago
cpanel is a web-based thing though, isn't it? You'd need shell access to the host to execute `sudo` and attempt to exploit it.
- jart 6y ago
  CPanel is a web gui for managing Linux systems. It's mainly used to configure and resell apache virtual hosts. Shell accounts is one of the things it manages. These companies normally have like hundreds of customers per server since they charge ~$1/month for hosting. So anyone who pays one dollar a month extra for shell access can compromise a whole lot of people. I tried tweeting at these virtual hosting providers to bring the vulnerability to their attention, but no one's responded.

thricegr8 6y ago

Here is a non .txt format with a great video explanation as well: https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit https://blog.qualys.com/vulnerabilities-research/2021/01/26/...

bpiche 6y ago

Please let this be a reference to Count Zero and the loa of the matrix :(

MayeulC 6y ago

Memory safety strikes again, it seems (overflow in a C string due to complex parameter parsing rules).

ddevault 6y ago
No, complexity strikes again. I haven't used sudo in years, preferring to use doas now. Its essential code is less than 500 lines and it does everything I've ever used sudo for, and that includes much more than `sudo <runupdates>`. $ man doas | wc -l 58 $ man doas.conf | wc -l 101 $ man sudo | wc -l 741 $ man sudoers | wc -l 3254 And a bonus: $ man sudoers | grep -C1 despair The sudoers file grammar will be described below in Extended Backus-Naur Form (EBNF). Don't despair if you are unfamiliar with EBNF; it is fairly simple, and the definitions below are annotated. That only accounts for a small subset of sudo's complexity. It's easily 100x more complex than it needs to be to solve this problem. Now compare the two CVE lists: http://ftp.netbsd.org/pub/pkgsrc/current/pkgsrc/security/doas/README.html http://ftp.netbsd.org/pub/pkgsrc/current/pkgsrc/security/doa... http://ftp.netbsd.org/pub/pkgsrc/current/pkgsrc/security/sudo/README.html http://ftp.netbsd.org/pub/pkgsrc/current/pkgsrc/security/sud... My reaction to this vulnerability was mild amusement, then later wondering if I should go discredit the inevitable Rust brigade. We don't have to rewrite everything in Rust to get better security. We just have to use simpler tools.
- comex 6y ago
  But if sudo were written in Rust, it could have the same level of complexity and not be vulnerable. Yes, it would still be vulnerable to logic errors, like the last famous sudo bug where you pass -1 as the UID. But it wouldn't be vulnerable to this. (And this isn't the first memory safety bug to be found in sudo.) Yes, sudo's complexity is useless for 99.99% of its users. But wouldn't it be nice if the result were merely a gross feeling rather than a security hole?
  - ddevault 6y ago
    >But if sudo were written in Rust, it could have the same level of complexity and not be vulnerable. This is not true. Complexity breeds bugs, including security bugs, and memory safety doesn't change that. Your example is a good one - here's another: doas once failed to limit the environment variables which are passed to the child process, which could be used to nefariously influence the program running (e.g. with LD_PRELOAD). How would Rust prevent that oversight? It wouldn't. A simpler program will generally be more secure than a complicated one, no matter what language either is written in. Furthermore, rewriting an established program from one language to another will always introduce more bugs than it fixes, and more severely the more complex the program is. The single best way to improve security is to reduce the attack surface, and the single best way to do that is to reduce the complexity of your system.

nickweb 6y ago

Is it normal for a security issue of this magnitude to have a 12 day notification period for everyone? That seems... short.

jwilk 6y ago
Yes. This was coordinated on the distros mailing list, which has maximum embargo period of 14 days, with periods shorter than 7 days preferable: https://oss-security.openwall.org/wiki/mailing-lists/distros#list-policy-and-instructions-for-reporters https://oss-security.openwall.org/wiki/mailing-lists/distros...
- cpncrunch 6y ago
  Still no update for Centos 8, so I'm not sure that worked too well.

hpcl 6y ago

For years we have been indoctrinated that having a root account is evil and sudo is the proper salvation. Turns out that any user could make a root account.

deleted 6y ago

[deleted]

cjohnson318 6y ago

Any idea why did they referenced Baron Samedi? https://en.wikipedia.org/wiki/Baron_Samedi https://en.wikipedia.org/wiki/Baron_Samedi

prutschman 6y ago
I think it's a pun on the `sudoedit` utility used in one of the exploit paths.
- cjohnson318 6y ago
  Oohhf.
tekstar 6y ago
He shows up in a William Gibson novel, in the Neuromancer series.

deleted 6y ago

[deleted]

jeffbee 6y ago

All you need to know about sudo and frankly most other pieces of the Linux userspace is that it is undertested. The commit that added this flaw to sudo claims to fix a parser bug but includes no tests. There is no reason for the author, the reviewer (if there even was such a person), or anyone else to believe that the bug existed or was fixed by this change. The pull request that supposedly fixes this CVE also includes no tests. There is no reason anyone should believe this fix is effective or complete, or that it does not introduce new defects. This is the result of people who stubbornly refuse to practice even the most basic good engineering practices, like testing and code review, while at the same time using the industry's most dangerous high-level language. As long as this type of thing continues, our tools will remain at a very low level of safety, reliability, and correctness.

nsajko 6y ago
I think the design of the relevant code is worse than the lack of relevant test coverage. The problem solved insecurely by the code instead seems like an obvious target for lexical and syntactic analysis (and this has been so since the sixties, I think).
- megous 6y ago
  Yes, please at least use re2c when parsing anything more complicated in C. The result is much more readable, and integration costs are pretty low, and you still keep a lot of flexibility in how you structure your code.
miohtama 6y ago
Another question is who wants to maintain four decades old GNU C soup? It was written at a different time, with different best practices. In some point someone will rewrite all GNU/UNIX user land in modern Rust or similar and save the day. Until this happens these kind of incidents will happen yearly.
- jeffbee 6y ago
  The GNU project is wall-to-wall toxic waste, but I note for the record that I don't think sudo is a GNU program and IIRC it's not even GPL.

Panino 6y ago

Qualys is great! Love their vulnerability reports. Just want to echo other praise here for doas. It's fantastic, most likely does everything you need it to do, and is secure. Install it and see for yourself!

cpncrunch 6y ago
I hadn't heard of Qualys until today, and am very unhappy with them. They have thrown us all under the bus by releasing details of this vulnerability before updates are available for major distros. (Still no update for Centos 8 at time of writing this, not sure about any others).
- ilikejam 6y ago
  RedHat built the fixed sudo RPMs 5 days ago.
  - cpncrunch 6y ago
    They only released it yesterday: https://access.redhat.com/security/cve/CVE-2021-3156 https://access.redhat.com/security/cve/CVE-2021-3156 Still nothing on Centos. Perhaps just another reason to not trust Redhat.
    - cpncrunch 6y ago
      Update is finally here.

bluefox 6y ago

Every now and then we all get a glimpse, for a flash of a moment, that the house of cards has already collapsed. Too invested in our current systems to face this truth, we just update and forget about it until the next time.

monadic3 6y ago
This seems so silly. There are about a billion linux distros. How come none of them focus on removing functionality? Surely most lines in sudo.c are unused in the average use case. Just remove them.

tgbugs 6y ago

Yet another vindication for one of my long-standing practices. I try to avoid installing sudo at all cost on my systems because all it does is increase the attack surface. Despite this, the wisdom of the crowd is that you should never su to root, for ... reasons? Fat fingering is a thing, but if you can accidentally be in a root terminal without realizing it you have done something horribly wrong. Heck, from a certain point of view if you have someone in the habit of repeatedly typing sudo over and over again then all sudo has really done is open up every single terminal to be a gateway to the nether realm of super user privs. And in this case, more attack surface.

tbrownaw 6y ago
> Despite this, the wisdom of the crowd is that you should never su to root, for ... reasons? `su` takes the password of the user you're becoming, while `sudo` takes the password (or not) of the user you already are. So using `su` to become root implies that there's a root password that multiple people (well, assuming there's multiple admins on the box) know.
- zests 6y ago
  sudo su My favorite command.
  - koprulusector 6y ago
    This is so silly that it's absolutely ludicrous, but I've never known about or used that before....... I can think of all kinds of other permutations of the command that I've used and know but not this one......
- nsajko 6y ago
  If a system is configured as you describe, that just means that it then effectively has an additional root/admin account, except under a possibly unpredictable name. So security through obscurity, really (if the privileged user name is secret). That might make sense for some small number of setups, but instead it seems to be enormously popular, and often times it is even used in the security-defeating manner of having the "usual" user be privileged.

YetAnotherNick 6y ago

From 2017, there are at least 5 discovered security issues in sudo[1]. It seems a bit too untested for something running in root and interacting with all users. [1]: https://www.sudo.ws/ https://www.sudo.ws/

saagarjha 6y ago
The kernel "runs as root and interacts with all users" and has a lot more than 5 discovered security issues ;)

statquontrarian 6y ago

How does this story not have a billion upvotes? HN should introduce sticky posts just for this bug and keep it at the top of the homepage for weeks. > exploitable by any local user [...] without authentication > introduced in July 2011 [...] in their default configuration > full root privileges

statquontrarian 6y ago
The actual commit: https://github.com/sudo-project/sudo/commit/8255ed69 https://github.com/sudo-project/sudo/commit/8255ed69
- sat_nam 6y ago
  Thanks for sharing this. I was looking for it on the mercurial repo at sudo.ws, but the commit didn't match. I found it here: https://www.sudo.ws/repos/sudo/rev/f666191a4e80 https://www.sudo.ws/repos/sudo/rev/f666191a4e80

tehjoker 6y ago

Are e.g. AWS, GCP, and Digital Ocean releasing emergency patches? I can't find info.

syngrog66 6y ago

this doesnt surprise me a few years ago I found a flaw in sshd. because it was impacting a Linux PAM login/auth module I was writing in C. my module should have worked. but it wasnt. because of sshd. it blew me away, given how important that server is. luckily, others must have complained too, and it ended up being fixed in a newer sshd release. but the fact that it made it into a release in the first place, impacting PAM, was scary on a not-totally-unrelated note, that was also the last C project I wrote, and since then I fell in love with Go and Rust. for systems code, for me, theres no going back. C is scary given the modern threat ecosystem and whats at stake

pengaru 6y ago

There's a reason my boxen have no sudo installed.

mbrubeck 6y ago

Just ten days ago on Hacker News, we had a C programmer claiming that “buffer over-runs are a rare class of bugs, and a class of bugs that are (at least on the heap, and often on the stack) trivial to find and fix” [1]. As a bonus, the person who wrote that turned out to have published C code containing multiple exploitable buffer overflows. [1]: https://news.ycombinator.com/item?id=25806533 https://news.ycombinator.com/item?id=25806533

nahsjP 6y ago
Of course not as secure as Firefox, which enables WASM by default. Or Chromium, which runs chrome-sandbox under suid.

0xbadcafebee 6y ago

I was trying to find results for PAM in CVEDB so I could go "Everybody's freaking out about sudo but PAM ain't no saint neither (https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PAM https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PAM)", but sudo's vulns seemed to really stack up last year: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=sudo https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=sudo

Uptrenda 6y ago

Wow, this looks bad. Many VPS and shared hosting providers would be directly shellable with this. Even exploits that got you onto a web server with a limited web shell = full root. Alternatively, sites that already have shells from previous script kiddies can be escalated to root too. Not that I would advocate any of this ^_^ But there are many places where local access is required and you rely on permissions to work properly. A program as important as sudo (or wide spread) is not the kind of place you want to see a vuln this severe

bolangi 6y ago

If little sudo has buffer overflows, what can we expect in the huge codebases of DBus and systemd?

mleonhard 6y ago

Is there a project to rewrite all of these Linux system utilities in forbid(unsafe) Rust?

cyounkins 6y ago

What variant of `doas` do people run as an alternative? I see Duncaen/OpenDoas, slicer69/doas, multiplexd/doas on GitHub. None seem super widely used as judged by watches/stars/forks.

duncaen 6y ago
I would say that the concept and implementation in C is inherently insecure. Switching to something less reviewed because there is a sudo vulnerability is not a guarantee that you are now "safer" especially if those ports are not reviewed. As far as I can say, never ever use slicer69/doas, I've found 3 critical security vulnerabilities in it, the author does not understand C or how it should work in general. Here are 3 examples if issues I found and the author used misleading commit titles to hide the issues and made excuses saying a clear buffer overflow very similar to the one found in sudo is just "potential": - https://github.com/slicer69/doas/commit/261c2164496dbebe6e3e7191db3dd7c840f6af58 https://github.com/slicer69/doas/commit/261c2164496dbebe6e3e... - https://github.com/slicer69/doas/commit/2f83222829448e5bc4c9391d607ec265a1e06531 https://github.com/slicer69/doas/commit/2f83222829448e5bc4c9... I even had to do a PR myself to fix an issue the author was not able to understand and more and more people started to use it: - https://github.com/slicer69/doas/pull/23 https://github.com/slicer69/doas/pull/23
- cyounkins 6y ago
  Oh dear... Thank you for that info.
anoki 6y ago
opendoas. It's a port of OpenBSD doas by a void linux developer.

higerordermap 6y ago

At this point, can somebody recommend linux security best practices on desktop? I already have two user accounts one for important stuff and other for unimportant stuff. I prefer to use sandboxed apps, but flatpaks don't look well maintained compared to official repositories, and often unofficial. Firejail seems quite controversial due to use of UserNS? What do veterans in security recommend for sandboxing of user apps?