The Patching Friars' AlmanacA calendar of CVE saints

Patron of January 26

Baron SameditHoly card for baron-samedit, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 \ Baron Samedit SUDO ERGO SUM
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint Baron Samedit, Lord of the Dead and of sudo

Patron of people who type sudo out of habit, backslashes at the end of the line, and decade-old bugs.

Life

On 26 January 2021 Qualys revealed a heap overflow in sudo, the command sysadmins invoke the most. Calling sudoedit with -s and an argument ending in a backslash was enough to become root, even without being in the sudoers file. It had been there for almost ten years, and the name, blending voodoo's Baron Samedi with sudoedit, suits a saint who raises privileges from the dead.

Prayer

O Saint Baron Samedit, who opens the gates of root with a single backslash, let our sudo ask everyone for the password. Amen.

How to celebrate

Celebrated by updating sudo and, by tradition, wearing a top hat.

One backslash, and the world turns upside down.

Technical record

Disclosed on
January 26 2021
CVE
CVE-2021-3156
CVSS
7.8Actively exploited (CISA KEV)
Product
Sudo · Sudo

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

Sources: blog.qualys.com

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.