Hacker News Reader

Comment by raimue | Hacker News Reader

I don't know much about WSL, but the instructions for this do not look right. Isn't WSL usually just a Linux distribution, so you should also use the package manager?

If you just run ./configure && make && sudo make install, sudo will be installed to /usr/local as prefix. Doesn't this mean the unpatched binary at /usr/bin/sudoedit will still be accessible?

View on HN

Right, the correct solution here for WSL would also be to run "apt-get upgrade" or whatever your distro uses.

I noticed that I had a typo in my command.

-- original comment

You can run it but it doesn't find anything. https://www.youtube.com/watch?v=iRIXXUNkgAM&t=1244s

I think you accidentally typoed the first command "apt-get update" as "apt-get upgrade", which is why it didn't work there.

Good spot! AFAIK Ubuntu under WSL(2) uses the same update repository as a non-WSL variants, so you shouldn't get different results.

Correct! Thank you!

Yeah the instructions are poorly written. Also, in my case (ubuntu 20.04) running `sudo apt-get --only-upgrade install sudo` does nothing, the latest version available is 1.8.31-1ubuntu1.2.

That version has the patches for this CVE. https://launchpad.net/ubuntu/+source/sudo/1.8.31-1ubuntu1.2

I had basically the same comment on the first HN posts about it. Just because `sudo -V` doesn't say 1.9.5p2 doesn't mean you're still vulnerable... https://news.ycombinator.com/item?id=25920839

Did you run sudo apt-get update first?

I'm running WSL 2 here with Ubuntu 20.04 LTS and this is what worked for me, without having to install anything from source.

Without doing anything (vulnerable):

    nick:~ $ sudoedit -s '\' `perl -e 'print "A" x 65536'`
    malloc(): corrupted top size
    Aborted

Then I ran this to patch it:

    sudo apt-get update && sudo apt-get --only-upgrade install sudo

And now this is the output (I guess not vulnerable anymore):

    nick:~ $ sudoedit -s '\' `perl -e 'print "A" x 65536'`
    usage: sudoedit [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p prompt] [-T timeout] [-u user] file ...

After patching it `dpkg -l | grep sudo` reports 1.8.31-1ubuntu1.2. I didn't think to run that before patching it but I'd guess it's going to be different.

Reply on news.ycombinator.com