Skip to content
Fencer Vulns
high 7.8

CVE-2021-3156 kev in the critical feed json

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root…

published 2021-01-26 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-26500

cvss
7.8
version 3.1, CNA
cisa kev
Exploited
added 2022-04-06
epss
100.0%
EPSS 100.0% chance of exploitation in 30 days, percentile 99.9%
public exploits
3
Metasploit, Exploit-DB

Summary

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • sudo_project sudo 1.8.32, 1.9.5
  • beyondtrust privilege_management_for_mac 21.1.1
  • beyondtrust privilege_management_for_unix/linux 10.3.2-10
  • sudo Debian 14, Debian 13, Debian 12 1.9.5p1-1.1

debian advisories DEBIAN-CVE-2021-3156

  • sudo Ubuntu 16.04 LTS 1.8.16-0ubuntu1.10
  • sudo Ubuntu 18.04 LTS 1.8.21p2-3ubuntu1.4
  • sudo Ubuntu 20.04 LTS 1.8.31-1ubuntu1.2
  • sudo Ubuntu Pro 14.04 LTS 1.8.9p5-1ubuntu1.5+esm6

ubuntu advisories UBUNTU-CVE-2021-3156

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • redhat-virtualization-host rhev hypervisor 4.4 4.4.4-20210201.0.el8_3
  • redhat-virtualization-host-image-update rhev hypervisor 4.4 4.4.4-20210201.0.el8_3
  • redhat-virtualization-host RHEL 7 4.3.13-20210127.0.el7_9
  • redhat-virtualization-host-image-update RHEL 7 4.3.13-20210127.0.el7_9
  • sudo RHEL 7 1.8.23-10.el7_9.1
  • sudo RHEL 8 1.8.29-6.el8_3.1
  • sudo RHEL 7.6 EUS 1.8.23-3.el7_6.2
  • sudo RHEL 7.7 EUS 1.8.23-4.el7_7.3

red hat advisories RHSA-2021:0401RHSA-2021:0395RHSA-2021:0223RHSA-2021:0222RHSA-2021:0221RHSA-2021:0220

  • sudo SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +12 more 1.8.22-4.18.1
  • sudo SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.8.27-4.15.1
  • sudo SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES 12 SP4-LTSS +7 more 1.8.20p2-3.23.1
  • sudo SLES 12 SP2-BCL 1.8.10p3-10.35.1
  • sudo SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +1 more 1.8.10p3-10.32.1
  • sudo SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +1 more 1.8.10p3-10.29.1
  • sudo SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +12 more 1.8.22-4.15.1
  • sudo SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES 12 SP4-LTSS +8 more 1.8.20p2-3.20.1

suse advisories SUSE-SU-2024:4389-1SUSE-SU-2021:1275-1SUSE-SU-2021:1274-1SUSE-SU-2021:1273-1SUSE-SU-2021:1267-1SUSE-SU-2021:0928-1

  • sudo openSUSE Tumbleweed 1.9.7p2-1.4
  • sudo openSUSE Leap 15.2 1.8.22-lp152.8.9.1
  • sudo openSUSE Leap 15.2 1.8.22-lp152.8.6.1
  • sudo openSUSE Leap 15.1 1.8.22-lp151.5.12.1

opensuse advisories openSUSE-SU-2024:11413-1openSUSE-SU-2021:0602-1openSUSE-SU-2021:0170-1openSUSE-SU-2021:0169-1

  • sudo Alpine 3.18, Alpine 3.17, Alpine 3.16 +5 more 1.9.5p2-r0
  • sudo Alpine 3.11 1.8.31-r1
  • sudo Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 1.9.5_p2-r0

alpine advisories ALPINE-CVE-2021-3156

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • sudo Arch Linux 1.9.5.p2-1

arch linux advisories AVG-1431

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3156 updated cvss 7.8

sudo: Heap buffer overflow in argument parsing

  • Red Hat Enterprise Linux BaseOS (v. 8) sudo 1.8.29-6.el8_3.1
    fixed: vendor fix RHSA-2021:0218
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.1) sudo 1.8.25p1-8.el8_1.2
    fixed: vendor fix RHSA-2021:0220
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.2) sudo 1.8.29-5.el8_2.1
    fixed: vendor fix RHSA-2021:0219
  • Red Hat Enterprise Linux Client (v. 7) sudo 1.8.23-10.el7_9.1 Red Hat Enterprise Linux Client Optional (v. 7) sudo-devel 1.8.23-10.el7_9.1, sudo-debuginfo 1.8.23-10.el7_9.1
    fixed: vendor fix RHSA-2021:0221
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) sudo 1.8.23-3.el7_6.2
    fixed: vendor fix RHSA-2021:0223
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) sudo 1.8.23-4.el7_7.3
    fixed: vendor fix RHSA-2021:0222
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7) sudo-devel 1.8.23-10.el7_9.1, sudo-debuginfo 1.8.23-10.el7_9.1
    fixed: vendor fix RHSA-2021:0221
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) sudo-devel 1.8.23-3.el7_6.2, sudo-debuginfo 1.8.23-3.el7_6.2
    fixed: vendor fix RHSA-2021:0223
show 22 more
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) sudo-devel 1.8.23-4.el7_7.3, sudo-debuginfo 1.8.23-4.el7_7.3
    fixed: vendor fix RHSA-2021:0222
  • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) sudo 1.8.23-3.el7_6.2 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) sudo-devel 1.8.23-3.el7_6.2, sudo-debuginfo 1.8.23-3.el7_6.2
    fixed: vendor fix RHSA-2021:0223
  • Red Hat Enterprise Linux Server (v. 6 ELS) sudo 1.8.6p3-29.el6_10.4
    fixed: vendor fix RHSA-2021:0227
  • Red Hat Enterprise Linux Server (v. 7) sudo 1.8.23-10.el7_9.1
    fixed: vendor fix RHSA-2021:0221
  • Red Hat Enterprise Linux Server AUS (v. 7.2) sudo 1.8.6p7-17.el7_2.3
    fixed: vendor fix RHSA-2021:0226
  • Red Hat Enterprise Linux Server AUS (v. 7.3) sudo 1.8.6p7-23.el7_3.3
    fixed: vendor fix RHSA-2021:0225
  • Red Hat Enterprise Linux Server AUS (v. 7.4) sudo 1.8.19p2-12.el7_4.2 Red Hat Enterprise Linux Server E4S (v. 7.4) sudo 1.8.19p2-12.el7_4.2
    fixed: vendor fix RHSA-2021:0224
  • Red Hat Enterprise Linux Server EUS (v. 7.6) sudo 1.8.23-3.el7_6.2
    fixed: vendor fix RHSA-2021:0223
  • Red Hat Enterprise Linux Server EUS (v. 7.7) sudo 1.8.23-4.el7_7.3
    fixed: vendor fix RHSA-2021:0222
  • Red Hat Enterprise Linux Server Optional (v. 6 ELS) sudo-devel 1.8.6p3-29.el6_10.4, sudo-debuginfo 1.8.6p3-29.el6_10.4
    fixed: vendor fix RHSA-2021:0227
  • Red Hat Enterprise Linux Server Optional (v. 7) sudo-devel 1.8.23-10.el7_9.1, sudo-debuginfo 1.8.23-10.el7_9.1
    fixed: vendor fix RHSA-2021:0221
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.2) sudo-devel 1.8.6p7-17.el7_2.3, sudo-debuginfo 1.8.6p7-17.el7_2.3
    fixed: vendor fix RHSA-2021:0226
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.3) sudo-devel 1.8.6p7-23.el7_3.3, sudo-debuginfo 1.8.6p7-23.el7_3.3
    fixed: vendor fix RHSA-2021:0225
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.4) sudo-devel 1.8.19p2-12.el7_4.2, sudo-debuginfo 1.8.19p2-12.el7_4.2 Red Hat Enterprise Linux Server Optional E4S (v. 7.4) sudo-devel 1.8.19p2-12.el7_4.2, sudo-debuginfo 1.8.19p2-12.el7_4.2
    fixed: vendor fix RHSA-2021:0224
  • Red Hat Enterprise Linux Server Optional EUS (v. 7.6) sudo-devel 1.8.23-3.el7_6.2, sudo-debuginfo 1.8.23-3.el7_6.2
    fixed: vendor fix RHSA-2021:0223
  • Red Hat Enterprise Linux Server Optional EUS (v. 7.7) sudo-devel 1.8.23-4.el7_7.3, sudo-debuginfo 1.8.23-4.el7_7.3
    fixed: vendor fix RHSA-2021:0222
  • Red Hat Enterprise Linux Server Optional TUS (v. 7.4) sudo-devel 1.8.19p2-12.el7_4.2, sudo-debuginfo 1.8.19p2-12.el7_4.2 Red Hat Enterprise Linux Server TUS (v. 7.4) sudo 1.8.19p2-12.el7_4.2
    fixed: vendor fix RHSA-2021:0224
  • Red Hat Enterprise Linux Workstation (v. 7) sudo 1.8.23-10.el7_9.1 Red Hat Enterprise Linux Workstation Optional (v. 7) sudo-devel 1.8.23-10.el7_9.1, sudo-debuginfo 1.8.23-10.el7_9.1
    fixed: vendor fix RHSA-2021:0221
  • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host 4.3.13-20210127.0.el7_9, redhat-virtualization-host-image-update 4.3.13-20210127.0.el7_9
    fixed: vendor fix RHSA-2021:0395
  • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host 4.4.4-20210201.0.el8_3, redhat-virtualization-host-image-update 4.4.4-20210201.0.el8_3
    fixed: vendor fix RHSA-2021:0401
  • Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-virtualization-host 4.3.13-20210127.0.el7_9, redhat-virtualization-host-image-update 4.3.13-20210127.0.el7_9
    fixed: vendor fix RHSA-2021:0395
  • Red Hat Enterprise Linux 5 sudo Red Hat Enterprise Linux 9 sudo, sudo-python-plugin Red Hat Virtualization 4 Hypervisor for RHEL 8 sssd 2.3.0-9.el8, sssd-ad 2.3.0-9.el8, sssd-ipa 2.3.0-9.el8, sssd-kcm 2.3.0-9.el8, samba 4.12.3-12.el8.3, sssd-dbus 2.3.0-9.el8, +25 more Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts vdsm 4.30.51-1.el7ev, vdsm-api 4.30.51-1.el7ev, vdsm-http 4.30.51-1.el7ev, vdsm-client 4.30.51-1.el7ev, vdsm-common 4.30.51-1.el7ev, vdsm-python 4.30.51-1.el7ev, +17 more Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host 4.3.13-2.el7ev, redhat-virtualization-host-image-update-placeholder 4.3.13-2.el7ev
    not affected: vulnerable code not present

1 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-256-01 updated cvss 7.8

Hitachi Energy TXpert Hub CoreTec 4 Sudo Vulnerability

  • Hitachi Energy TXpert Hub CoreTec 4 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.2.0, 2.2.1
    affected: vendor fix, mitigation “Physically protect process control systems from unauthorized direct access.” search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-21-334-04 updated cvss 7.8

Johnson Controls CEM Systems AC2000

  • Contolled Electronic Management Systems Ltd, Johnson Contols Inc. CEM Systems AC2000 < 10.6
    affected: mitigation “Note: AC2000 v10.6 includes a fixed version of sudo.” johnsoncontrols.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-21-245-01 updated cvss 7.8

Johnson Controls Sensormatic Electronics Illustra

  • Sensormatic Electronics, LLC, Johnson Controls Inc. Flex Gen 2 < 1.9.4 Sensormatic Electronics, LLC, Johnson Controls Inc. Insight < 1.4.0 Sensormatic Electronics, LLC, Johnson Controls Inc. Pro 2 Sensormatic Electronics, LLC, Johnson Controls Inc. Pro Gen 3 < 2.8.0
    affected: fixed in 2.8.0, mitigation “Flex Gen 2: upgrade to Version 1.9.4” johnsoncontrols.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-21-147-02 updated cvss 7.8

Johnson Controls Sensormatic Electronics VideoEdge

  • Sensormatic Electronics, LLC, Johnson Controls Inc. VideoEdge < 5.7.0
    affected: vendor fix, mitigation “American Dynamics is a Johnson Controls brand. Users may contact American Dynamics technical support for assistance with updating their operating system. https://www.americandynamics.net/Support” americandynamics.net

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-21-133-02 updated cvss 7.8

Johnson Controls Sensormatic Tyco AI

  • Sensormatic Electronics, LLC, Johnson Controls Inc. Tyco AI <= v1.2
    affected: vendor fix tyco.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-21-119-03 updated cvss 7.0

Johnson Controls Exacq Technologies exacqVision

  • Exacq Technologies, Johnson Controls Inc. exacqVision Linux based Z-Series and A-Series, Q-Series, G-Series, Legacy LC-Series
    affected: mitigation “Johnson Controls recommends users install the latest security updates for the Ubuntu Linux operating system.” exacq.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

  1. Published
  2. First public exploit (Metasploit exploit/linux/local/sudo_baron_samedit)
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
4 y ago
Patch by
2022-04-27 (4 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
Sudo, Sudo
CISA name
Sudo Heap-Based Buffer Overflow Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
21 mo ago

Exploit prediction

99.96% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/linux/local/sudo_baron_samedit Sudo Heap-Based Buffer Overflow metasploit exploit, excellent rank, 2021-01-26
  • EDB-49522 Sudo 1.9.5p1 - 'Baron Samedit ' Heap-Based Buffer Overflow Privilege Escalation (2) local, 2021-02-03
  • EDB-49521 Sudo 1.9.5p1 - 'Baron Samedit ' Heap-Based Buffer Overflow Privilege Escalation (1) local, 2021-02-03
  • seclists.org http://seclists.org/fulldisclosure/2021/Jan/79 referenced PoC, tagged "exploit" by a source, unverified
  • openwall.com http://www.openwall.com/lists/oss-security/2021/01/26/3 referenced PoC, tagged "exploit" by a source, unverified
  • openwall.com http://www.openwall.com/lists/oss-security/2021/02/15/1 referenced PoC, tagged "exploit" by a source, unverified
  • openwall.com https://www.openwall.com/lists/oss-security/2021/01/26/3 referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.html referenced PoC, tagged "exploit" by a source, unverified
  • openwall.com http://www.openwall.com/lists/oss-security/2024/01/30/6 referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html referenced PoC, tagged "exploit" by a source, unverified
  • seclists.org http://seclists.org/fulldisclosure/2024/Feb/3 referenced PoC, tagged "exploit" by a source, unverified
  • vicarius.io https://www.vicarius.io/vsociety/posts/sudoedit-pwned-cve-2021-3156 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.