CVE-2021-3156: Sudo Baron Samedit 堆缓冲区溢出提权漏洞

Sudo Baron Samedit 漏洞 (CVE-2021-3156) 深度剖析：参数解析逻辑对末尾反斜杠的转义失误，如何让系统任意无特权用户在默认配置下直接拿到 Root 权限。

💡 通俗易懂的原理解析 (ELI5)

想象一下公文审核员有一条铁律：遇到反斜杠转义符，就必须把后面的那个字符原样抄下来。有人故意递交了一份以反斜杠结尾的申请表。审核员在纸面上找不到下一个字符，不仅没有停止，反而笔尖直接划出纸张边缘，抄到桌面底下的绝密档案堆上，将档案上的'禁止进入'涂改成了'放行'。

核心概念与专有名词

setuid 二进制文件: 以所有者（root）权限而非调用者权限执行的可执行程序。
堆缓冲区溢出: 向堆内存分配块之外写入数据，破坏相邻内存控制结构。
本地权限提升: 普通低权限系统用户借此直接获取最高超级用户（root）权限。

根本原因剖析 (Root Cause)

根本原因在于开源系统中未经验证的边界参数，导致状态不同步并绕过安全控制。

攻击执行流程分解

Step 1

Trailing Backslash Injection

Unprivileged user executes 'sudoedit -s \', bypassing normal argument escaping flags.

Step 2

Unterminated Buffer Traversal

The unescape pointer jumps past the null byte delimiter into uninitialized heap memory.

Step 3

Heap Corruption of Service Structures

The heap overflow overwrites the sudo_nss service structure in glibc.

Step 4

Root Privilege Escalation

Sudo loads an attacker-controlled shared library (/tmp/libnss_x.so.2) as root, granting instant root shell access.

源代码对比：漏洞与安全实现

✕ 存在漏洞的实现

/* VULNERABLE: Unescape loop skips past string termination null byte */
for (to = user_args, from = NewArgv[0]; *from != '\0'; from++) {
    if (from[0] == '\\' && !isspace((unsigned char)from[1]))
        from++; /* BUG: If from[1] == '\0', loop skips past null terminator! */
    *to++ = *from;
}
*to = '\0'; /* Corrupts adjacent heap chunks with root auth structures */

✓ 加固后的安全修复

/* FIXED: Explicitly check that from[1] is neither space nor the null byte */
for (to = user_args, from = NewArgv[0]; *from != '\0'; from++) {
    if (from[0] == '\\' && from[1] != '\0' && !isspace((unsigned char)from[1]))
        from++;
    *to++ = *from;
}
*to = '\0';

工程与系统安全加固清单

✓Unprivileged user executes sudoedit -s '\', bypassing normal escaping flags.:
✓The unescape pointer jumps past the null byte into uninitialized heap memory.:
✓The heap overflow overwrites the sudo_nss service structure in glibc.:
✓Sudo loads an attacker-controlled shared library (/tmp/libnss_x.so.2) as root, granting instant root shell access.: