Sudo heap overflow: Replicating CVE-2021-3156 with AFL

Preparing the environment

First, we need to install AFL. You just have to clone the repo and follow the instructions. The only necessary change I made was to specify a version for the libstdc++-dev package. It needs to be the same as the gcc compiler on your system:

$ git clone https://github.com/AFLplusplus/AFLplusplus.git
$ cd AFLplusplus/
$ gcc --version
gcc (Debian 10.2.1-6) 10.2.1 20210110
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
$ sudo apt install build-essential python3-dev automake flex bison libglib2.0-dev libpixman-1-dev clang python3-setuptools clang llvm llvm-dev libstdc++-10-dev
$ make distrib
$ sudo make

And check the installation with:

$ afl-gcc --version
afl-cc ++3.01a by Michal Zalewski, Laszlo Szekeres, Marc Heuse - mode: GCC-GCC
gcc (Debian 10.2.1-6) 10.2.1 20210110
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for

Now, we need to download one of the affected versions of sudo. We will use 1.9.5p1.

wget -c

That’s it, we have everything we need!

Patching sudo for fuzzing purposes

AFL uses instrumented fuzzing only on binaries built with their compilers. Instrumented mode helps AFL perform coverage-guided fuzzing and generate mutating input based on the measured behavior of previous payloads.

However, AFL will expect parameters from the standard input and files only.

sudo uses command-line arguments, which is not compatible with AFL. However, there is a way provided by AFL to fuzz that kind of binaries: A C header that converts a standard input payload to argv[] parameters.

To do that, we just need to:

• Copy the AFLplusplus/utils/argv_fuzzing/argv-fuzz-inl.h file to the main source of sudo.

• Modify the main() function of sudo to call the AFL_INIT_ARGV() macro.

~/sudo-1.9.5p1$ cp

This will work by converting all the expected argv[] array from standard input with parameters separated by a \0 byte and terminating the array with a \0\0.

We also need to disable the sudo password prompt; otherwise, the fuzzing will hang.

Now, we can build our patched sudo. As it needs to be built with AFL compilers, we must overwrite the CC environment variable. We may also want to enable debugging symbols, and finally we should install it on a isolated path so we can safely remove it when we finish our fuzzing session. We can do that by issuing:

CFLAGS="-g" LDFLAGS="-g" CC=afl-clang-fast ./configure --prefix=/fuzz/sudo
make
sudo make

This will install our modified sudo on /fuzz/sudo. To check that our installation worked, along with the patches, just type:

echo -ne "sudo\0id\0\0" | /fuzz/sudo/bin/sudo
uid=0(root) gid=0(root) groups=0

Great, now it’s fuzzing time!

Fuzzing sudo

When using AFL, I recommend having a separate directory on which you can store the inputs and outputs for each fuzzed binary. I will create mine at $HOME/fuzz/sudo.

~/fuzz$ mkdir -p sudo

The output directory will be on where AFL will store the fuzzing state. As this directory will be extensively written to, it is recommended to use a RAM-based filesystem to improve performance and avoid damaging SSD disks.

~/fuzz/sudo$ sudo mount -t

In the input directory, we will create initial payloads for sudo:

~/fuzz/sudo$ echo -ne "sudo\0id\0\0" > input/payload1
~/fuzz/sudo$ echo -ne "sudoedit\0id\0\0"

Fuzzing is CPU-intensive, but you can use parallel fuzzing with AFL. I used an 8-core PC and launched a Master AFL instance:

~/fuzz/sudo$ afl-fuzz -i input/ -o output/ -M

And launched 6 Slave instances on different consoles:

~/fuzz/sudo$ afl-fuzz -i input/ -o output/ -S fuzz02 /fuzz/sudo/bin/sudo
~/fuzz/sudo$ afl-fuzz -i input/ -o output/ -S fuzz03 /fuzz/sudo/bin/sudo
~/fuzz/sudo$ afl-fuzz -i input/ -o output/ -S fuzz04 /fuzz/sudo/bin/sudo
~/fuzz/sudo$ afl-fuzz -i input/ -o output/ -S fuzz05 /fuzz/sudo/bin/sudo
~/fuzz/sudo$ afl-fuzz -i input/ -o output/ -S

It looked like this:

And just after a few minutes of fuzzing, one of the slaves showed 3 crashes!

You can find here the payloads that caused the crashes:

~/fuzz/sudo$ ls output/fuzz03/crashes/id\:00000*
4 output/fuzz03/crashes/id:000000,sig:06,src:000002+000209,time:276568,op:splice,rep:2
4 output/fuzz03/crashes/id:000001,sig:06,src:000125,time:404770,op:havoc,rep:8
4

If we examine the contents of these payloads, we can see that they all invoked sudoedit with the -s and -i flags. AFL mutated the original input payloads and eventually triggered the bug found by Qualys.

We can also replicate the crash by simply passing the offending payloads to our sudo:

~/fuzz/sudo$ /fuzz/sudo/bin/sudo < output/fuzz03/crashes/id:000000,sig:06,src:000002+000209

And you can use GDB to start the exploitation process:

Conclusion

It is easy to find crashes on software using AFL if you have the source code. What is unbelievable is that it took 10 years for a bug like this to be found on sudo!