Apple Patches 10-Year-Old macOS SUDO Root Privilege Escalation Bug
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-1805 +1 in the same advisory: …1806 | An out-of-bounds write was addressed with improved input validation. An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2.1, macOS Catalina 10.15.7 Supplemental Update, macOS Mojave 10.14.6 Security Update 2021-002. An application may be able to execute arbitrary code with kernel privileges. NVD description · AI analysis pending | 7.8 group max | 1% |
| — | ||
| CVE-2021-3156 | Heap-Based Buffer Overflow in Sudo Enables Local Privilege Escalation (CVE-2021-3156) CVE-2021-3156 is an off-by-one error (CWE-193) in the Unix Sudo utility that causes a heap-based buffer overflow (CWE-122) in Sudo's handling of command-line arguments. It is triggered locally when an unprivileged user invokes Sudo with specially crafted arguments, requiring no special privileges or non-default configuration. A successful exploit allows the attacker to execute arbitrary code as root, achieving full local privilege escalation on the host. Any Linux, Unix, or other system running a vulnerable version of Sudo is affected, and because Sudo ships by default on virtually all such systems the potential footprint is enormous. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-04-06) and carries a 100% EPSS probability of exploitation within 30 days, indicating active in-the-wild exploitation, though specific ransomware use is unknown. Do: Upgrade Sudo to a patched release (1.9.5p2 or later, or the vendor-supplied update for your distribution) per vendor instructions, as required by the CISA KEV listing. Audit all Unix-like hosts by checking the installed Sudo version through your package manager and prioritize patching multi-user and internet-facing servers. Restricting local shell access and monitoring for anomalous Sudo invocations can reduce risk while patching completes. | 7.8 | 100% | KEV PoC ×12 |
| masstens of millions of Linux/Unix servers, workstations and devices (Sudo is preinstalled on virtually all Linux distributions) |
Full article421 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananFeb 10, 2021
Apple has rolled out a fix for a critical sudo vulnerability in macOS Big Sur, Catalina, and Mojave that could allow unauthenticated local users to gain root-level privileges on the system.
"A local attacker may be able to elevate their privileges," Apple said in a security advisory. "This issue was addressed by updating to sudo version 1.9.5p2."
Sudo is a common utility built into most Unix and Linux operating systems that lets a user without security privileges access and run a program with the credentials of another user.
Tracked as CVE-2021-3156 (also called "Baron Samedit"), the vulnerability first came to light last month after security auditing firm Qualys disclosed the existence of a heap-based buffer overflow, which it said had been "hiding in plain sight" for almost 10 years.
The vulnerability, which was introduced in the code back in July 2011, impacts sudo versions 1.7.7 through 1.7.10p9, 1.8.2 through 1.8.31p2, and 1.9.0 through 1.9.5p1, following which the maintainers released 1.8.32 and 1.9.5p2 to resolve the issue.
While the weakness can only be exploited by an attacker already having access to a vulnerable host, the barrier could be easily bypassed by planting malware on a device or brute-forcing a low-privileged service account.
In its report, Qualys researchers said they managed to develop multiple variants of exploit and obtain full root privileges on Ubuntu 20.04 (Sudo 1.8.31), Debian 10 (Sudo 1.8.27), and Fedora 33 (Sudo 1.9.2).
But last week, British security researcher Matthew Hickey discovered that the vulnerability also extended to the latest version of macOS Big Sur 11.2, prompting Apple to address the security shortcoming.
"CVE-2021-3156 also impacts @apple MacOS Big Sur (unpatched at present), you can enable exploitation of the issue by symlinking sudo to sudoedit and then triggering the heap overflow to escalate one's privileges to 1337 uid=0," Hickey tweeted on February 2.
Besides the fix for the sudo vulnerability, Tuesday's supplemental security update also includes patches for two flaws in Intel Graphics Driver (CVE-2021-1805 and CVE-2021-1806), which could cause an application to execute arbitrary code with kernel privileges.
The vulnerabilities, which stem from an out-of-bounds write and a race condition, respectively, were rectified with additional validation, the iPhone maker said.
Mac users who haven't opted to check for updates automatically can head to Apple menu > System Preferences, and then click Software Update to download and install the latest updates.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2021/02/apple-patches-10-year-old-macos-sudo.html