Reproducing Baron Samedit (CVE-2021-3156)

Overview

Working in a group with fellow students, we analysed and reproduced Baron Samedit, a heap-based buffer overflow in sudo’s command-line argument parsing, triggered through how sudo handles escaped characters when running in shell mode. The bug allows any local user to escalate to root, without needing to be listed in the sudoers file.

Approach

• Set up an isolated Ubuntu 20.04 VM and downgraded to sudo 1.8.31, the last version affected by the bug,
• Reproduced two independent proof-of-concept exploits, Worawit’s and Blasty’s, to compare exploitation strategies, one hijacking sudo’s NSS service_user lookup, the other hijacking its shared-library loading path,
• Traced how each exploit used heap grooming to position its target structure directly after the overflowed buffer, then triggered the single-byte overflow with a trailing backslash in a shell-mode argument,
• Confirmed both exploits escalated to a root shell.

Validating the patch

After confirming the exploits worked, we applied the official patched version of sudo and reran both proof-of-concepts. The overflow no longer occurred, and we documented the difference in behaviour before and after patching as part of the writeup.

Key takeaways

• Both exploits reliably escalated from an unprivileged user to root,
• The flaw was a single missing check, an off-by-one error that went unnoticed for nearly a decade,
• Traditional testing wasn’t enough to catch it, since the triggering conditions were rare.