Re: Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156)

[Hanno Böck <hanno () hboeck de>]

Hi,

Just sharing a few thoughts and things I read elsewhere:

complexity
==========

The top comment on lobste.rs points out that a problem of sudo is
complexity:
https://lobste.rs/s/efsvqu/heap_based_buffer_overflow_sudo_cve_2021#c_c6fcfa

I think that's a very fair point. Also it seems the development trend
in sudo is to actually increase complexity even more and adding all
kinds of features that really should not be part of a suid tool, see
e.g.
https://computingforgeeks.com/better-secure-new-sudo-release/

The lobste.rs poster points to doas, which seems to be a much simpler
alternative coming from OpenBSD, a portable version exists:
https://github.com/Duncaen/OpenDoas

testing
=======

Top commenter at HN points out that there's a lack of testing in sudo:
https://news.ycombinator.com/item?id=25921811

Neither the commit that introduced this bug nor the commit that fixed
it contained a test.

Fair point again.
Here doas does not compare well: It does not seem to come with a test
suite at all.


-- 
Hanno Böck
https://hboeck.de/