A recently discovered root exploit vulnerability in Linux has been found to affect Apple Inc.’s macOS as well.

The vulnerability allows for an attacker to trigger a so-called heap overflow in Sudo, a program for Unix-like computer operating systems. It allow users to run security privileges of another user in order to gain access to other accounts on the operating system to which they shouldn’t otherwise have access.

Researchers at Qualysis Inc. first identified the vulnerability Jan. 26 and said that they had found it in Ubuntu 20.04 (Sudo 1.8.31), Debian 10 (Sudo 1.8.27) and Fedora 33 (Sudo 1.9.2) but also noted that it may affect other operating systems. Matthew Hickey, the co-founder of Hacker House, has since discovered that the vulnerability also affects macOS Big Sur, demonstrating Tuesday on Twitter how he was able to exploit it.

“To trigger it, you just have to overwrite argv[0] or create a symlink, which therefore exposes the OS to the same local root vulnerability that has plagued Linux users the last week or so,” Hickey told ZDNet today.

MacOS has its roots in Unix and includes Sudo support, hence why it’s also vulnerable. Exactly how many versions of macOS are vulnerable, however, is unknown. The Sudo vulnerability itself is believed to have existed for at least 10 years before being discovered. That means that potentially macOS versions going back as far OS X 10.7 Lion released in 2011 or even earlier versions may also be exposed to the vulnerability.

Apple has so far not commented on the report. Linux distributors are in the process of patching the vulnerability and it’s likely that Apple will follow suit.

“By itself, a privilege escalation vulnerability might not be especially dangerous for most users,” Jonathan Knudsen, a technical evangelist at electronic design automation company Synopsys Inc., told SiliconANGLE. “It could only be exploited if an attacker already has access to your computer, either locally or through a remote shell.”

Chained together with one or more other exploits, though, that risk could be multiplied, he added. “If an attacker exploits another vulnerability to run code as a regular user, then they can trivially run the exploit for CVE-2021-3156 to gain administrative access, allowing them to take complete control of your computer,” he said,

MacOS users should apply updates from Apple as soon as the fix for the vulnerability is available, he advised. “In the meantime, try to avoid risky situations,” he said. “Keep your other software up to date, don’t click on dodgy links, don’t click on email attachments unless you’re confident about their origins, disable network services you are not using and so forth.”

Image: Apple