<story><title>Buffer overflow when pwfeedback is set in sudoers</title><url>https://www.sudo.ws/alerts/pwfeedback.html</url></story><parent_chain><item><author>akersten</author><text>Every time I see a fiddly fix like this where we&amp;#x27;re changing a buffer counter to a postfix instead of a prefix increment, I always think &amp;quot;why are we doing this shit ourselves?&amp;quot;&lt;p&gt;We should have standardized a C API to safely read&amp;#x2F;write buffers from files, networks, etc. decades ago. But here we are in 2020 manually moving pointers around - and what a surprise that we&amp;#x27;re finding &amp;quot;whoops, another off-by-one error, you know how it goes.&amp;quot;&lt;p&gt;No one should be writing new code to read&amp;#x2F;write bytes. This should be settled. It&amp;#x27;s like a carpenter building their own nail gun each time they want to build a house.</text></item><item><author>stefan_</author><text>Best part is the fix:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;sudo-project&amp;#x2F;sudo&amp;#x2F;commit&amp;#x2F;b5d2010b6514ff45693509273bb07df3abb0bf0a&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;sudo-project&amp;#x2F;sudo&amp;#x2F;commit&amp;#x2F;b5d2010b6514ff45...&lt;/a&gt;&lt;p&gt;Time to delete sudo.</text></item><item><author>masklinn</author><text>Just in from “C is fine just know what you’re doing”.&lt;p&gt;&amp;gt; Exploiting the bug does not require sudo permissions, merely that pwfeedback be enabled.&lt;p&gt;&amp;gt; the stack overflow may allow unprivileged users to escalate to the root account. Because the attacker has complete control of the data used to overflow the buffer, there is a high likelihood of exploitability.</text></item></parent_chain><comment><author>codeflo</author><text>The prefix&amp;#x2F;postfix change is a red herring, that doesn&amp;#x27;t do anything (since the expression result isn&amp;#x27;t used). Which means that the security fix is interspersed with code style changes. Maybe there&amp;#x27;s a reason to do this here, but it&amp;#x27;s often not considered good practice because it makes it harder to review the code.&lt;p&gt;AFAICT, the only real changes are in (new) line 411, resetting the cp variable after the loop, and line 416, ignoring write errors. The former is probably the relevant one.</text></comment>
<story><title>Buffer overflow when pwfeedback is set in sudoers</title><url>https://www.sudo.ws/alerts/pwfeedback.html</url></story><parent_chain><item><author>akersten</author><text>Every time I see a fiddly fix like this where we&amp;#x27;re changing a buffer counter to a postfix instead of a prefix increment, I always think &amp;quot;why are we doing this shit ourselves?&amp;quot;&lt;p&gt;We should have standardized a C API to safely read&amp;#x2F;write buffers from files, networks, etc. decades ago. But here we are in 2020 manually moving pointers around - and what a surprise that we&amp;#x27;re finding &amp;quot;whoops, another off-by-one error, you know how it goes.&amp;quot;&lt;p&gt;No one should be writing new code to read&amp;#x2F;write bytes. This should be settled. It&amp;#x27;s like a carpenter building their own nail gun each time they want to build a house.</text></item><item><author>stefan_</author><text>Best part is the fix:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;sudo-project&amp;#x2F;sudo&amp;#x2F;commit&amp;#x2F;b5d2010b6514ff45693509273bb07df3abb0bf0a&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;sudo-project&amp;#x2F;sudo&amp;#x2F;commit&amp;#x2F;b5d2010b6514ff45...&lt;/a&gt;&lt;p&gt;Time to delete sudo.</text></item><item><author>masklinn</author><text>Just in from “C is fine just know what you’re doing”.&lt;p&gt;&amp;gt; Exploiting the bug does not require sudo permissions, merely that pwfeedback be enabled.&lt;p&gt;&amp;gt; the stack overflow may allow unprivileged users to escalate to the root account. Because the attacker has complete control of the data used to overflow the buffer, there is a high likelihood of exploitability.</text></item></parent_chain><comment><author>scintill76</author><text>&amp;gt; we&amp;#x27;re changing a buffer counter to a postfix instead of a prefix increment&lt;p&gt;Maybe I&amp;#x27;m missing something, but wasn&amp;#x27;t that a pointless change? The value of the expression was unused, so post- and pre- are equivalent.</text></comment>