---
title: "Detect Baron Samedit CVE-2021-3156 Segfault"
excerpt: "Exploitation for Privilege Escalation"
categories:
  - Endpoint
last_modified_at: 2021-01-29
toc: true
toc_label: ""
tags:
  - Exploitation for Privilege Escalation
  - Privilege Escalation
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  - CVE-2021-3156
---

### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.


[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

#### Description

This search detects the heap-based buffer overflow of sudoedit

- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: 
- **Last Updated**: 2021-01-29
- **Author**: Shannon Davis, Splunk
- **ID**: 10f2bae0-bbe6-4984-808c-37dc1c67980d


#### [ATT&CK](https://attack.mitre.org/)

| ID             | Technique        |  Tactic             |
| -------------- | ---------------- |-------------------- |
| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |

#### Search

```
`linux_hosts` 
| search sudoedit segfault 
| stats count min(_time) as firstTime max(_time) as lastTime by host 
| search count > 5 
| `detect_baron_samedit_cve_2021_3156_segfault_filter`
```

#### Macros
The SPL above uses the following Macros:
* [linux_hosts](https://github.com/splunk/security_content/blob/develop/macros/linux_hosts.yml)

Note that `detect_baron_samedit_cve-2021-3156_segfault_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

#### Required field
* _time
* host


#### How To Implement
Splunk Universal Forwarder running on Linux systems (tested on Centos and Ubuntu), where segfaults are being logged.  This also captures instances where the exploit has been compiled into a binary. The detection looks for greater than 5 instances of sudoedit combined with segfault over your search time period on a single host

#### Known False Positives
If sudoedit is throwing segfaults for other reasons this will pick those up too.

#### Associated Analytic story
* [Baron Samedit CVE-2021-3156](/stories/baron_samedit_cve-2021-3156)


#### Kill Chain Phase
* Exploitation




Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`


#### CVE

| ID          | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
| [CVE-2021-3156](https://nvd.nist.gov/vuln/detail/CVE-2021-3156) | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via &#34;sudoedit -s&#34; and a command-line argument that ends with a single backslash character. | 7.2 |



#### Reference

* [https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit](https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit)



#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)




[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/detect_baron_samedit_cve-2021-3156_segfault.yml) \| *version*: **1**