Baron Samedit (CVE-2021-3156)
Sudo Heap-Based Buffer Overflow Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply updates per vendor instructions.
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2021-3156
Also Known as Baron Samedit
Baron Samedit is a heap-based buffer overflow in sudo, named by its discoverer Qualys and disclosed on January 26, 2021. Any local user can use it to gain root, and it affected sudo releases going back to a July 2011 change.
Description
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
Severity
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitation Context
as of October 13, 2026- CISA added CVE-2021-3156 to the KEV catalog 435 days after its CVE record was published.
- It is one of 2 Sudo entries in the CISA KEV catalog, and the only one added in 2022.
- Its current EPSS score (100.0%) is higher than that of 94% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| - | - | n/a |
References
34 Links- [debian-lts-announce] 20210126 [SECURITY] [DLA 2534-1] sudo security update
- 20210126 Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156)
- [oss-security] 20210126 Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156)
- [oss-security] 20210127 Re: Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156)
- [oss-security] 20210127 Re: Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156)
- 20210211 APPLE-SA-2021-02-09-1 macOS Big Sur 11.2.1, macOS Catalina 10.15.7 Supplemental Update, and macOS Mojave 10.14.6 Security Update 2021-002
- [oss-security] 20210215 Re: sudo: Ineffective NO_ROOT_MAILER and Baron Samedit
- [oss-security] 20210914 Re: Oracle Solaris membership in the distros list
- [oss-security] 20240130 Re: CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog()
- [oss-security] 20240130 CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog()
- 20240204 CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog()
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.sudo.ws/stable.html#1.9.5p2
- https://www.openwall.com/lists/oss-security/2021/01/26/3
- http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html
- https://security.netapp.com/advisory/ntap-20210128-0002/
- https://security.netapp.com/advisory/ntap-20210128-0001/
- http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html
- http://packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.html
- http://packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.html
- https://support.apple.com/kb/HT212177
- https://kc.mcafee.com/corporate/index?page=content&id=SB10348
- https://www.beyondtrust.com/blog/entry/security-advisory-privilege-management-for-unix-linux-pmul-basic-and-privilege-management-for-mac-pmm-affected-by-sudo-vulnerability
- https://www.synology.com/security/advisory/Synology_SA_21_02
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
- https://www.vicarius.io/vsociety/posts/sudoedit-pwned-cve-2021-3156
Record Details
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.