Detect Baron Samedit CVE-2021-3156 Segfault

name: Detect Baron Samedit CVE-2021-3156 Segfault
id: 10f2bae0-bbe6-4984-808c-37dc1c67980d
version: 8
date: '2026-03-10'
author: Shannon Davis, Splunk
status: experimental
type: TTP
description: The following analytic identifies a heap-based buffer overflow in sudoedit by detecting Linux logs containing both "sudoedit" and "segfault" terms. This detection leverages Splunk to monitor for more than five occurrences of these terms on a single host within a specified timeframe. This activity is significant because exploiting this vulnerability (CVE-2021-3156) can allow attackers to gain root privileges, leading to potential system compromise, unauthorized access, and data breaches. If confirmed malicious, this could result in elevated privileges and full control over the affected system, posing a severe security risk.
data_source: []
search: |-
    `linux_hosts` TERM(sudoedit) TERM(segfault)
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY host
      | where count > 5
      | `detect_baron_samedit_cve_2021_3156_segfault_filter`
how_to_implement: Splunk Universal Forwarder running on Linux systems (tested on Centos and Ubuntu), where segfaults are being logged.  This also captures instances where the exploit has been compiled into a binary. The detection looks for greater than 5 instances of sudoedit combined with segfault over your search time period on a single host
known_false_positives: If sudoedit is throwing segfaults for other reasons this will pick those up too.
references: []
rba:
    message: Potential Baron Samedit segfault on $host$
    risk_objects:
        - field: host
          type: system
          score: 50
    threat_objects: []
tags:
    analytic_story:
        - Baron Samedit CVE-2021-3156
    asset_type: Endpoint
    cve:
        - CVE-2021-3156
    mitre_attack_id:
        - T1068
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: endpoint