Detect Baron Samedit CVE-2021-3156 Segfault

Status: experimental
Severity: medium
Group by: host
Author: Shannon Davis, Splunk
Source: github.com/splunk/security_content

The following analytic identifies a heap-based buffer overflow in sudoedit by detecting Linux logs containing both "sudoedit" and "segfault" terms. This detection leverages Splunk to monitor for more than five occurrences of these terms on a single host within a specified timeframe. This activity is significant because exploiting this vulnerability (CVE-2021-3156) can allow attackers to gain root privileges, leading to potential system compromise, unauthorized access, and data breaches. If confirmed malicious, this could result in elevated privileges and full control over the affected system, posing a severe security risk.

Known false positives

If sudoedit is throwing segfaults for other reasons this will pick those up too.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1068` Exploitation for Privilege Escalation

Rule body

name: Detect Baron Samedit CVE-2021-3156 Segfault
id: 10f2bae0-bbe6-4984-808c-37dc1c67980d
version: 9
creation_date: '2021-01-28'
modification_date: '2026-05-13'
author: Shannon Davis, Splunk
status: experimental
type: TTP
description: The following analytic identifies a heap-based buffer overflow in sudoedit by detecting Linux logs containing both "sudoedit" and "segfault" terms. This detection leverages Splunk to monitor for more than five occurrences of these terms on a single host within a specified timeframe. This activity is significant because exploiting this vulnerability (CVE-2021-3156) can allow attackers to gain root privileges, leading to potential system compromise, unauthorized access, and data breaches. If confirmed malicious, this could result in elevated privileges and full control over the affected system, posing a severe security risk.
data_source: []
search: |-
    `linux_hosts` TERM(sudoedit) TERM(segfault)
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY host
      | where count > 5
      | `detect_baron_samedit_cve_2021_3156_segfault_filter`
how_to_implement: Splunk Universal Forwarder running on Linux systems (tested on Centos and Ubuntu), where segfaults are being logged.  This also captures instances where the exploit has been compiled into a binary. The detection looks for greater than 5 instances of sudoedit combined with segfault over your search time period on a single host
known_false_positives: If sudoedit is throwing segfaults for other reasons this will pick those up too.
references: []
finding:
    title: Potential Baron Samedit segfault on $host$
    entity:
        field: host
        type: system
        score: 50
analytic_story:
    - Baron Samedit CVE-2021-3156
asset_type: Endpoint
cve:
    - CVE-2021-3156
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

Stages and Predicates

Stage 1: `search`

`linux_hosts` TERM(sudoedit) TERM(segfault)

Stage 2: `stats`

| stats count min(_time) as firstTime max(_time) as lastTime
    BY host

Stage 3: `where`

| where count > 5

Stage 4: `search`

| `detect_baron_samedit_cve_2021_3156_segfault_filter`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`count`	gt	`5`	`field:"count" kind:gt value:"5"`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`sudoedit`
1	`segfault`