CVE-2021-3864

HIGH

Linux Kernel - Improper Access Control via SUID Binary Core Dump Handling

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-3864. PoCs published by walac.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2021-3864, a local privilege escalation vulnerability in sudo. The exploit leverages a heap-based buffer overflow in sudo's command-line argument parsing to execute arbitrary commands as root via a crafted logrotate configuration file.

Description

A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that sets real UID equal to effective UID, and real GID equal to effective GID. The descendant will then have a dumpable value set to 1. As a result, if the descendant process crashes and core_pattern is set to a relative value, its core dump is stored in the current directory with uid:gid permissions. An unprivileged local user with eligible root SUID binary could use this flaw to place core dumps into root-owned directories, potentially resulting in escalation of privileges.

Exploits (1)

nomisec WORKING POC

by walac · poc

https://github.com/walac/cve-2021-3864

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2021-3864, a local privilege escalation vulnerability in sudo. The exploit leverages a heap-based buffer overflow in sudo's command-line argument parsing to execute arbitrary commands as root via a crafted logrotate configuration file.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: sudo (versions before 1.9.5p2)

Auth required

Prerequisites: Local user access · Ability to modify /etc/sudoers · Ability to modify /etc/logrotate.d

MITRE ATT&CK