CVE-2021-3156

sudo project sudo, fedoraproject fedora, debian linux

Published 26 Jan 2021 · updated 17 Jun 2026 · Analyzed

7.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 6 Apr 2022, with a remediation deadline of 27 Apr 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

References

packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html · Exploit, Third Party Advisory, VDB Entry
packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html · Exploit, Third Party Advisory, VDB Entry
packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.html · Exploit, Third Party Advisory, VDB Entry
packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.html · Exploit, Third Party Advisory, VDB Entry
packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html · Exploit, Third Party Advisory, VDB Entry
seclists.org/fulldisclosure/2021/Feb/42 · Mailing List, Third Party Advisory
seclists.org/fulldisclosure/2021/Jan/79 · Exploit, Mailing List, Third Party Advisory
seclists.org/fulldisclosure/2024/Feb/3 · Exploit, Mailing List, Third Party Advisory
www.openwall.com/lists/oss-security/2021/01/26/3 · Exploit, Mailing List, Third Party Advisory
www.openwall.com/lists/oss-security/2021/01/27/1 · Mailing List, Third Party Advisory
www.openwall.com/lists/oss-security/2021/01/27/2 · Mailing List, Third Party Advisory
www.openwall.com/lists/oss-security/2021/02/15/1 · Exploit, Mailing List, Third Party Advisory
www.openwall.com/lists/oss-security/2021/09/14/2 · Mailing List, Patch, Third Party Advisory
www.openwall.com/lists/oss-security/2024/01/30/6 · Exploit, Mailing List
www.openwall.com/lists/oss-security/2024/01/30/8 · Mailing List
kc.mcafee.com/corporate/index?page=content&id=SB10348 · Broken Link, Third Party Advisory
lists.debian.org/debian-lts-announce/2021/01/msg00022.html · Mailing List, Third Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CALA5FTXIQBRRYUA2ZQNJXB6OQMAXEII/ · Mailing List, Release Notes
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LHXK6ICO5AYLGFK2TAX5MZKUXTUKWOJY/ · Mailing List, Release Notes
security.gentoo.org/glsa/202101-33 · Third Party Advisory
security.netapp.com/advisory/ntap-20210128-0001/ · Third Party Advisory
security.netapp.com/advisory/ntap-20210128-0002/ · Third Party Advisory
support.apple.com/kb/HT212177 · Third Party Advisory
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sudo-privesc-jan2021-qnYQfcM · Third Party Advisory
www.beyondtrust.com/blog/entry/security-advisory-privilege-management-for-unix-linux-pmul-basic-and-privilege-management-for-mac-pmm-affected-by-sudo-vulnerability · Third Party Advisory