Sudo (CVE-2021-3156) - I went looking for a CVE exploit and found a different bug instead, which got patched.

As i'm migrating from old Diary, i've decided to repost just a few selected post that i consider worth keeping. Not for the quality of the post, but for the content. I try to reformat it to dev.to standard anyway. (Even though it appears that "dev.to" standard is AI Slop). This post was written @ 16 January 2024. Exploring CVE-2021-3156 @ home Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. This is what I understood : You can use multiple line in argument by escaping with \ Sudo ignore the character following \ what if \ is the last character ? it ignores \0 (NULL) and read stuff it shouldn't read because the null terminator is ignored. Let's find out. The commit fixing the bug is here and here and ... here ? This was also submitted by Qualys the same day, let's assume it's part of it Well... it's not as s