macOS Sudo vulnerability could give root privileges to any local user
A decade-old flaw found in the Sudo tool could lead to root access on Unix-based systems, including macOS Big Sur and earlier versions.
Sudo exploit in Unix could lead to root access
In January, security researchers disclosed a new vulnerability that can affect Unix-based operating systems. The exploit is identified as CVE-2021-3156, heap-based buffer overflow in Sudo. The exploit appears similar to a previously patched flaw called CVE-2019-18634.
The researchers at Qualys identified the exploit in Ubuntu 20.04 (Sudo 1.8.31), Debian 10 (Sudo 1.8.27), and Fedora 33 (Sudo 1.9.2). They say it can affect other operating systems and distributions running the affected version of Sudo. All legacy versions from 1.8.2 to 1.8.31p2 and all stable versions from 1.9.0 to 1.9.5p1 are affected.
The researchers note that users will need access to the computer to run the exploit. The exploit has existed for at least 10 years, however this is the first known documentation of it.
At first, it was not clear whether the vulnerability exists in macOS, but security researcher Matthew Hickey disclosed on Wednesday that the bug can also be exploited on Macs.
"To trigger it, you just have to overwrite argv[0] or create a symlink, which therefore exposes the OS to the same local root vulnerability that has plagued Linux users the last week or so," Matthew Hickey, co-founder of Hacker House told ZDNet.
Hickey's findings were confirmed by other prominent macOS security researchers. Patrick Wardle confirmed the findings to ZDNet, and vulnerability analyst Will Dormann verified the research in a tweet.
Now that the exploit has been made known to Linux distributors it will likely be patched soon. Apple could release a security update with the patch at any time, but users can act sooner if they feel it is necessary.
Qualys offers a paid program that explains how to patch the exploit, however most users will not need to concern themselves.
Hickey said he notified Apple of the security flaw earlier on Wednesday. Apple has declined to comment while it investigates the issue.
Sudo exploit in Unix could lead to root access
In January, security researchers disclosed a new vulnerability that can affect Unix-based operating systems. The exploit is identified as CVE-2021-3156, heap-based buffer overflow in Sudo. The exploit appears similar to a previously patched flaw called CVE-2019-18634.
The researchers at Qualys identified the exploit in Ubuntu 20.04 (Sudo 1.8.31), Debian 10 (Sudo 1.8.27), and Fedora 33 (Sudo 1.9.2). They say it can affect other operating systems and distributions running the affected version of Sudo. All legacy versions from 1.8.2 to 1.8.31p2 and all stable versions from 1.9.0 to 1.9.5p1 are affected.
The researchers note that users will need access to the computer to run the exploit. The exploit has existed for at least 10 years, however this is the first known documentation of it.
At first, it was not clear whether the vulnerability exists in macOS, but security researcher Matthew Hickey disclosed on Wednesday that the bug can also be exploited on Macs.
CVE-2021-3156 also impacts @apple MacOS Big Sur (unpatched at present), you can enable exploitation of the issue by symlinking sudo to sudoedit and then triggering the heap overflow to escalate one's privileges to 1337 uid=0. Fun for @p0sixninja pic.twitter.com/tyXFB3odxE
-- Hacker Fantastic (@hackerfantastic)
"To trigger it, you just have to overwrite argv[0] or create a symlink, which therefore exposes the OS to the same local root vulnerability that has plagued Linux users the last week or so," Matthew Hickey, co-founder of Hacker House told ZDNet.
Hickey's findings were confirmed by other prominent macOS security researchers. Patrick Wardle confirmed the findings to ZDNet, and vulnerability analyst Will Dormann verified the research in a tweet.
Can confirm with macOS Big Sur on both x86_64 and aarch64. pic.twitter.com/nQqQ8rskv7
-- Will Dormann (@wdormann)
Now that the exploit has been made known to Linux distributors it will likely be patched soon. Apple could release a security update with the patch at any time, but users can act sooner if they feel it is necessary.
Qualys offers a paid program that explains how to patch the exploit, however most users will not need to concern themselves.
Who's at risk, and how to protect yourself
The vulnerability exists in both older and recent macOS versions, so it appears that a significant number of Macs can be exploited. However, since the vulnerability requires local access to the computer and the exact exploitation has not been made public, it is unlikely any regular user will be affected prior to a macOS update.Hickey said he notified Apple of the security flaw earlier on Wednesday. Apple has declined to comment while it investigates the issue.
Comments
Nice of him to give Apple an hour or two heads up before he went public. Not that big a deal in this case (since the Linux exploit was publicized so the question of what it affects Mac OS was an obvious next question), but still.
That said, Apple doesn't do that great of a job of keeping their open source Unix/Linux utilities all that up-to-date. They don't view them as a competitive differentiator, so they don't go out of their way to keep them forked and modified for their own purposes. But, they also don't seem to go out of their way to keep them up-to-date either. But that seems more of an attention issue than anything related to ideological or business motives.
But anyways, strategies for dealing with memory management is a bit of a digression here. The point is that, for smaller apps, auditing all sources of input data for buffer overflow/invalid data attacks, any external tools used for validity, etc, isn't a massive undertaking. But yeah, it seems like this was something missed in a recent change/addition to sudo, not a security hole which has been in the tool for ages.
The sudoers manpage alone is 2871 lines long. It opens with a "quick guide to Extended Backus-Naur Form", which is a language for defining the grammar of formal languages. That's gratuitously complicated. sudo's source tree has 374 C-language files in it right now.
In comparison, the whole of doas is ~1400 lines of code, including manpages for doas itself and its config file, doas.conf. A program that small is possible to reason about effectively.