CVE-2021-3156
7.8
HIGH
CVSS 3.1
EPSS 100.0% · 100th pctCISA KEV · Exploited in the wild
2021-01-26•Updated 2025-10-21•KEV 2022-04-06
CISA Known Exploited Vulnerabilities
Sudo Heap-Based Buffer Overflow Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Added to KEV
2022-04-06
Remediation due
2022-04-27
Required action
Apply updates per vendor instructions.
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2021-3156
Description
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
Severity
CVSS 3.1 · CISA7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSSVC · CISA-ADP
Exploitationactive
Automatableno
Technical impacttotal
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| - | - | n/a |
References
34 LinksVendor advisories
Third-party advisories
Mailing lists
- [debian-lts-announce] 20210126 [SECURITY] [DLA 2534-1] sudo security update
- 20210126 Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156)
- [oss-security] 20210126 Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156)
- [oss-security] 20210127 Re: Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156)
- [oss-security] 20210127 Re: Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156)
- 20210211 APPLE-SA-2021-02-09-1 macOS Big Sur 11.2.1, macOS Catalina 10.15.7 Supplemental Update, and macOS Mojave 10.14.6 Security Update 2021-002
- [oss-security] 20210215 Re: sudo: Ineffective NO_ROOT_MAILER and Baron Samedit
- [oss-security] 20210914 Re: Oracle Solaris membership in the distros list
- [oss-security] 20240130 Re: CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog()
- [oss-security] 20240130 CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog()
- 20240204 CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog()
Other references
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.sudo.ws/stable.html#1.9.5p2
- https://www.openwall.com/lists/oss-security/2021/01/26/3
- http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html
- https://security.netapp.com/advisory/ntap-20210128-0002/
- https://security.netapp.com/advisory/ntap-20210128-0001/
- http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html
- http://packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.html
- http://packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.html
- https://support.apple.com/kb/HT212177
- https://kc.mcafee.com/corporate/index?page=content&id=SB10348
- https://www.beyondtrust.com/blog/entry/security-advisory-privilege-management-for-unix-linux-pmul-basic-and-privilege-management-for-mac-pmm-affected-by-sudo-vulnerability
- https://www.synology.com/security/advisory/Synology_SA_21_02
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
- https://www.vicarius.io/vsociety/posts/sudoedit-pwned-cve-2021-3156
Record Details
Published
2021-01-26
Last updated
2025-10-21
Assigner (CNA)
mitre
Credited to
-
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.