CVE-2021-3156 : Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

Published 2021-01-26 21:15:13

Updated 2024-07-09 18:27:54

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowGain privilege

CVE-2021-3156 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Sudo Heap-Based Buffer Overflow Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2021-3156

Added on 2022-04-06 Action due date 2022-04-27

Exploit prediction scoring system (EPSS) score for CVE-2021-3156

EPSS FAQ

95.81%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2021-3156

Sudo Heap-Based Buffer Overflow

Disclosure Date: 2021-01-26

First seen: 2021-03-12

exploit/linux/local/sudo_baron_samedit

A heap based buffer overflow exists in the sudo command line utility that can be exploited by a local attacker to gain elevated privileges. The vulnerability was introduced in July of 2011 and affects version 1.8.2 through 1.8.31p2 as well as 1.9.0 through 1.9.5p1 in t

More information

CVSS scores for CVE-2021-3156

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2021-3156

CWE-193 Off-by-one Error

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-3156

http://www.openwall.com/lists/oss-security/2021/01/26/3

oss-security - Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156)
Exploit;Mailing List;Third Party Advisory
http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html

Sudo Buffer Overflow / Privilege Escalation ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
http://packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.html

Sudo 1.9.5p1 Buffer Overflow / Privilege Escalation ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
https://www.beyondtrust.com/blog/entry/security-advisory-privilege-management-for-unix-linux-pmul-basic-and-privilege-management-for-mac-pmm-affected-by-sudo-vulnerability

Security Advisory: Privilege Management for Unix & Linux Basic & Privilege Management for Mac | BeyondTrust
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html

Oracle Critical Patch Update Advisory - April 2022
Patch;Third Party Advisory

CVEs referencing this url
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sudo-privesc-jan2021-qnYQfcM

Sudo Privilege Escalation Vulnerability Affecting Cisco Products: January 2021
Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/01/30/6

oss-security - CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog()
Exploit;Mailing List

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CALA5FTXIQBRRYUA2ZQNJXB6OQMAXEII/

[SECURITY] Fedora 32 Update: sudo-1.9.5p2-1.fc32 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/01/27/1

oss-security - Re: Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156)
Mailing List;Third Party Advisory
https://security.netapp.com/advisory/ntap-20210128-0002/

CVE-2021-3156 Sudo Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/01/msg00022.html

[SECURITY] [DLA 2534-1] sudo security update
Mailing List;Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html

Oracle Critical Patch Update Advisory - July 2021
Patch;Third Party Advisory

CVEs referencing this url
https://www.sudo.ws/stable.html#1.9.5p2

Sudo Stable Release
Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LHXK6ICO5AYLGFK2TAX5MZKUXTUKWOJY/

[SECURITY] Fedora 33 Update: sudo-1.9.5p2-1.fc33 - package-announce - Fedora Mailing-Lists
Mailing List;Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CALA5FTXIQBRRYUA2ZQNJXB6OQMAXEII/

[SECURITY] Fedora 32 Update: sudo-1.9.5p2-1.fc32 - package-announce - Fedora Mailing-Lists
Mailing List;Release Notes
https://www.kb.cert.org/vuls/id/794544

VU#794544 - Heap-Based Buffer Overflow in Sudo
Third Party Advisory;US Government Resource
http://www.openwall.com/lists/oss-security/2021/09/14/2

oss-security - Re: Oracle Solaris membership in the distros list
Mailing List;Patch;Third Party Advisory

CVEs referencing this url
http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html

Sudo Heap-Based Buffer Overflow ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
http://www.openwall.com/lists/oss-security/2021/01/27/2

oss-security - Re: Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156)
Mailing List;Third Party Advisory
https://www.synology.com/security/advisory/Synology_SA_21_02

Synology Inc.
Third Party Advisory
http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html

glibc syslog() Heap-Based Buffer Overflow ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

CVEs referencing this url
http://seclists.org/fulldisclosure/2021/Feb/42

Full Disclosure: APPLE-SA-2021-02-09-1 macOS Big Sur 11.2.1, macOS Catalina 10.15.7 Supplemental Update, and macOS Mojave 10.14.6 Security Update 2021-002
Mailing List;Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/01/26/3

oss-security - Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156)
Exploit;Mailing List;Third Party Advisory
https://security.gentoo.org/glsa/202101-33

sudo: Multiple vulnerabilities (GLSA 202101-33) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://www.debian.org/security/2021/dsa-4839

Debian -- Security Information -- DSA-4839-1 sudo
Third Party Advisory
http://seclists.org/fulldisclosure/2021/Jan/79

Full Disclosure: Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156)
Exploit;Mailing List;Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html

Oracle Critical Patch Update Advisory - October 2021
Patch;Third Party Advisory

CVEs referencing this url
http://packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.html

Sudo 1.8.31p2 / 1.9.5p1 Buffer Overflow ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
http://www.openwall.com/lists/oss-security/2021/02/15/1

oss-security - Re: sudo: Ineffective NO_ROOT_MAILER and Baron Samedit
Exploit;Mailing List;Third Party Advisory
https://support.apple.com/kb/HT212177

About the security content of macOS Big Sur 11.2.1, macOS Catalina 10.15.7 Supplemental Update, and macOS Mojave 10.14.6 Security Update 2021-002 - Apple Support
Third Party Advisory
http://seclists.org/fulldisclosure/2024/Feb/3

Full Disclosure: CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog()
Exploit;Mailing List;Third Party Advisory

CVEs referencing this url
https://kc.mcafee.com/corporate/index?page=content&id=SB10348

McAfee Security Bulletin - Status and updates for Linux sudo vulnerability (CVE-2021-3156)
Broken Link;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LHXK6ICO5AYLGFK2TAX5MZKUXTUKWOJY/

[SECURITY] Fedora 33 Update: sudo-1.9.5p2-1.fc33 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/01/30/8

oss-security - Re: CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog()
Mailing List

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20210128-0001/

CVE-2020-8585 Sensitive Information Disclosure Vulnerability in OnCommand Unified Manager Core Package | NetApp Product Security
Third Party Advisory

CVEs referencing this url

Products affected by CVE-2021-3156

Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Performance Intelligence Center
Versions from including (>=) 10.3.0.0.0 and up to, including, (<=) 10.3.0.2.1
cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Performance Intelligence Center
Versions from including (>=) 10.4.0.1.0 and up to, including, (<=) 10.4.0.3.1
cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:*
Matching versions
Oracle » Micros Compact Workstation 3 Firmware » Version: 310
cpe:2.3:o:oracle:micros_compact_workstation_3_firmware:310:*:*:*:*:*:*:*
Matching versions
When used together with: Oracle » Micros Compact Workstation 3 » Version: N/A
Oracle » Micros Es400 Firmware
Versions from including (>=) 400 and up to, including, (<=) 410
cpe:2.3:o:oracle:micros_es400_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Oracle » Micros Es400 » Version: N/A
Oracle » Micros Kitchen Display System Firmware » Version: 210
cpe:2.3:o:oracle:micros_kitchen_display_system_firmware:210:*:*:*:*:*:*:*
Matching versions
When used together with: Oracle » Micros Kitchen Display System » Version: N/A
Oracle » Micros Workstation 5a Firmware » Version: 5A
cpe:2.3:o:oracle:micros_workstation_5a_firmware:5a:*:*:*:*:*:*:*
Matching versions
When used together with: Oracle » Micros Workstation 5a » Version: N/A
Oracle » Micros Workstation 6 Firmware
Versions from including (>=) 610 and up to, including, (<=) 655
cpe:2.3:o:oracle:micros_workstation_6_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Oracle » Micros Workstation 6 » Version: N/A
Oracle » Tekelec Platform Distribution
Versions from including (>=) 7.4.0 and up to, including, (<=) 7.7.1
cpe:2.3:a:oracle:tekelec_platform_distribution:*:*:*:*:*:*:*:*
Matching versions
Mcafee » Web Gateway » Version: 8.2.17
cpe:2.3:a:mcafee:web_gateway:8.2.17:*:*:*:*:*:*:*
Matching versions
Mcafee » Web Gateway » Version: 9.2.8
cpe:2.3:a:mcafee:web_gateway:9.2.8:*:*:*:*:*:*:*
Matching versions
Mcafee » Web Gateway » Version: 10.0.4
cpe:2.3:a:mcafee:web_gateway:10.0.4:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 32
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 33
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
Matching versions
Netapp » Oncommand Unified Manager Core Package » Version: N/A
cpe:2.3:a:netapp:oncommand_unified_manager_core_package:-:*:*:*:*:*:*:*
Matching versions
Netapp » Cloud Backup » Version: N/A
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
Matching versions
Netapp » Ontap Select Deploy Administration Utility » Version: N/A
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
Matching versions
Netapp » Hci Management Node » Version: N/A
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
Matching versions
Netapp » Solidfire » Version: N/A
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
Matching versions
Netapp » Active Iq Unified Manager » Version: N/A For Vmware Vsphere
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
Matching versions
Netapp » Ontap Tools » Version: 9 For Vmware Vsphere
cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*
Matching versions
Synology » Diskstation Manager » Version: 6.2
cpe:2.3:a:synology:diskstation_manager:6.2:*:*:*:*:*:*:*
Matching versions
Synology » Vs960hd Firmware » Version: N/A
cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Synology » Vs960hd » Version: N/A
Synology » Skynas Firmware » Version: N/A
cpe:2.3:o:synology:skynas_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Synology » Skynas » Version: N/A
Synology » Diskstation Manager Unified Controller » Version: 3.0
cpe:2.3:a:synology:diskstation_manager_unified_controller:3.0:*:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo
Versions from including (>=) 1.9.0 and before (<) 1.9.5
cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo
Versions from including (>=) 1.8.2 and before (<) 1.8.32
cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.9.5 Update Patch1
cpe:2.3:a:sudo_project:sudo:1.9.5:patch1:*:*:*:*:*:*
Matching versions
Sudo Project » Sudo » Version: 1.9.5
cpe:2.3:a:sudo_project:sudo:1.9.5:-:*:*:*:*:*:*
Matching versions
Beyondtrust » Privilege Management For Mac
Versions before (<) 21.1.1
cpe:2.3:a:beyondtrust:privilege_management_for_mac:*:*:*:*:*:*:*:*
Matching versions
Beyondtrust » Privilege Management For Unix/linux » Basic Edition
Versions before (<) 10.3.2-10
cpe:2.3:a:beyondtrust:privilege_management_for_unix\/linux:*:*:*:*:basic:*:*:*
Matching versions

Vulnerability Details : CVE-2021-3156