Root Access Sudo Bug Found to Affect macOS Big Sur

A sudo bug that can grant an attacker root access has been discovered to affect macOS Big Sur (via ZDNet).

sudo bug macos

The security vulnerability, identified last week as "CVE-2021-3156" by the Qualys Security Team, affects sudo, which is a program that allows users to run commands with the security privileges of another user, such as an administrator. The bug triggers a "heap overflow" in sudo that changes the current user's privileges to enable root-level access. This can give an attacker access to the entire system. An attacker would need to gain low-level access to a system first to be able to exploit the bug, such as via planted malware.

Sudo is part of many Unix-like systems, including macOS, but it was initially unknown if the vulnerability affected Mac machines since it was only tested by Qualys on Ubuntu, Debian, and Fedora. Security researcher Matthew Hickey has now confirmed that the most recent version of macOS, macOS Big Sur 11.2 can be subject to the sudo attack.

Last week, there was speculation that the macOS Big Sur 11.2 update may address the sudo vulnerability, though it was not definitively known at the time if the bug would affect macOS. While it was found that sudo was left unchanged in macOS Big Sur 11.2, it is now clear that macOS is affected by the exploit.

With some minor modifications, Hickey found that the sudo bug could be used to grant attackers access to macOS root accounts, and the discovery has now been verified by Carnegie Mellon University vulnerability analyst Will Dormann.

Apple has reportedly been notified of the CVE-2021-3156 vulnerability, and due to the severity of the issue, a patch will likely be released soon.

Top Rated Comments

AttoA Avatar
26 months ago

Apple rushing beta software to market, again.
This vulnerability has been present for more than a decade in all sorts of UNIXes! It's not something at all limited to Apple's QA...
Score: 34 Votes (Like | Disagree)
Havalo Avatar
26 months ago


Attachment Image
Score: 31 Votes (Like | Disagree)
mannyvel Avatar
26 months ago

So, mostly free OSes. That's much of a defense....

Devs knew about the potential, and chose not to address it. They would rather rush a beta product to market.
One day you will learn more about software and you will look back at this comment and say "wow, I was totally clueless back then."
Score: 27 Votes (Like | Disagree)
Gabebear Avatar
26 months ago

Wow I thought this would have been patched out in 11.2. Hopefully we will get a
supplemental patch shortly.
It turns most fairly minor security issues into full-blown root exploits… fairly terrifying.
Score: 9 Votes (Like | Disagree)
opfor Avatar
26 months ago

I'd think we'd have better tools/procedures for finding bugs like this a lot sooner.

Is there not an automated tool that can look at some code and say "hey, right here it's possible for a heap overflow to occur and there's no error handling code to deal with it"?
Sure there are tools that catch some of these problems via static analysis etc and there are languages where this class of problems might not even occur.

But it is also true that the day that the CVE was released I updated my Linux servers and got a fixed/patched sudo, while even macOS 11.3 beta1 still has the issue, so this is also indicative of Apple release engineering capabilities, or lack of them.
Score: 8 Votes (Like | Disagree)
justperry Avatar
26 months ago

So is this a zero day, drive-by vulnerability? Or does the attacker have to have physical access?
Nope

"An attacker would need to gain low-level access to a system first to be able to exploit the bug, such as via planted malware."
Score: 8 Votes (Like | Disagree)

Popular Stories

iOS 16

iOS 16.3 Now Available for Your iPhone With These 4 New Features

Friday February 3, 2023 1:13 pm PST by
Apple released iOS 16.3 in late January following nearly six weeks of beta testing. The software update is available for the iPhone 8 and newer, and while it is a relatively minor update, it still includes a handful of new features, changes, and bug fixes. Below, we've recapped new features in iOS 16.3, including support for physical security keys as a two-factor authentication option for...
iPhone 14 Pro Purple Side Perspective Feature Purple

Gurman: Apple Considering New High-End iPhone Alongside Pro and Pro Max

Sunday February 5, 2023 6:07 am PST by
Apple has discussed selling a new top-of-the-line iPhone alongside the Pro and Pro Max models in 2024 at the earliest, according to Bloomberg's Mark Gurman. Based on this timeframe, the device would be part of the iPhone 16 lineup or later. In a September 2022 edition of his weekly "Power On" newsletter, Gurman said there was "potential" for an iPhone 15 Ultra to replace the iPhone 15 Pro...
ipad air purple

Deals: M1 iPad Air Hits Record-Low Prices at TigerDirect, Starting at $313.99 (48% Off) [Updated]

Saturday February 4, 2023 10:05 am PST by
Online retailer TigerDirect has slashed pricing on the M1 iPad Air in several colors, offering the base 64GB configuration for just $313.99 in Purple and Pink. Note: MacRumors is an affiliate partner with TigerDirect. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. That's a savings of 48% compared to Apple's normal $599.00...
mac studio pink

Apple May Not Launch Updated Mac Studio With M2 Ultra Chip Due to Similarity With Upcoming Mac Pro

Sunday February 5, 2023 6:06 am PST by
A new version of the Mac Studio with the "M2 Ultra" chip is unlikely to arrive in the near future, according to Bloomberg's Mark Gurman. In the latest edition of his "Power On" newsletter, Gurman explained that since the upcoming Apple silicon Mac Pro is "very similar in functionality to the Mac Studio," Apple may wait until the release of M3- or M4-series chips to update the machine, or...
webkit vs chromium feature

Google Working on Browser for iOS That Would Break Apple's App Store Rules

Saturday February 4, 2023 1:30 am PST by
Google's Chromium developers are working on an experimental web browser for iOS that would break Apple's browser engine restrictions, The Register reports. The experimental browser, which is being actively pursued by developers, uses Google's Blink engine. Yet if Google attempted to release it on the App Store, it would not pass Apple's App Review process. Apple's App Store rules dictate...
Apple Silicon Teal Feature

The Next Big Apple Silicon Device May Not Be a Mac or iPad

Wednesday February 1, 2023 3:57 am PST by
Apple's next device with an Apple silicon chip may not be a Mac or an iPad, but rather an advanced external display, according to recent reports. The display, which is rumored to arrive this year, is expected to sit somewhere between the $1,599 Studio Display and the $4,999 Pro Display XDR – but more exact information about the device's positioning and price point is as yet unknown. While ...
top stories 4feb2023

Top Stories: New HomePod Launches, iOS 16.3.1 Coming Soon, and More

Saturday February 4, 2023 6:00 am PST by
This week saw the launch of the final product from Apple's January hardware announcements, with the second-generation HomePod making its way into customers' hands. Other news and rumors this week included signs of an interim iOS 16.3.1 bug fix update in the works as we await a fresh round of beta testing for a more significant iOS 16.4 update, a report on the potential dangers of using...
maxresdefault

Hands-On With Apple's Second-Generation HomePod

Friday February 3, 2023 1:28 pm PST by
Today is the official launch day for the second-generation HomePod that was introduced in January, and we picked one up to compare it to the original HomePod that Apple discontinued in 2021. Subscribe to the MacRumors YouTube channel for more videos. Design wise, the second-generation HomePod looks a lot like the first-generation model, featuring the same rounded design and acoustic mesh...