Sudo Heap-Based Buffer Overflow Attempt
editSudo Heap-Based Buffer Overflow Attempt
editIdentifies the attempted use of a heap-based buffer overflow vulnerability for the Sudo binary in Unix-like systems (CVE-2021-3156). Successful exploitation allows an unprivileged user to escalate to the root user.
Rule type: threshold
Rule indices:
- auditbeat-*
- logs-endpoint.events.*
Severity: high
Risk score: 73
Runs every: 5 minutes
Searches indices from: now-9m (Date Math format, see also Additional look-back time)
Maximum alerts per execution: 100
References:
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-3156
- https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit
- https://www.bleepingcomputer.com/news/security/latest-macos-big-sur-also-has-sudo-root-privilege-escalation-flaw
- https://www.sudo.ws/alerts/unescape_overflow.html
Tags:
- Elastic
- Host
- Linux
- macOS
- Threat Detection
- Privilege Escalation
Version: 2 (version history)
Added (Elastic Stack release): 7.12.0
Last modified (Elastic Stack release): 8.4.0
Rule authors: Elastic
Rule license: Elastic License v2
Potential false positives
editThis rule could generate false positives if the process arguments leveraged by the exploit are shared by custom scripts using the Sudo or Sudoedit binaries. Only Sudo versions 1.8.2 through 1.8.31p2 and 1.9.0 through 1.9.5p1 are affected; if those versions are not present on the endpoint, this could be a false positive.
Rule query
editevent.category:process and event.type:start and process.name:(sudo
or sudoedit) and process.args:(*\\ and ("-i" or "-s"))
Threat mapping
editFramework: MITRE ATT&CKTM
-
Tactic:
- Name: Privilege Escalation
- ID: TA0004
- Reference URL: https://attack.mitre.org/tactics/TA0004/
-
Technique:
- Name: Exploitation for Privilege Escalation
- ID: T1068
- Reference URL: https://attack.mitre.org/techniques/T1068/
Rule version history
edit- Version 2 (8.4.0 release)
-
- Formatting only