CVE-2021-3156
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s"…
High
Known exploited
- Severity
- 7.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 99.96%
- Chance of exploitation in the next 30 days. Higher than 99.98% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Apr 6, 2022
- Fix
- None yet
- No fixed version published
Exploited in the wild. Sudo Heap-Based Buffer Overflow Vulnerability (Sudo Sudo). Required action: Apply updates per vendor instructions. Due for U.S. federal agencies by Apr 27, 2022.
Description
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-193: Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
How to prevent it
- Implementation: When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array. Some examples of functions susceptible to this weakness in C include strcpy(), strncpy(), strcat(), strncat(), printf(), sprintf(), scanf() and sscanf().
CWE-193: Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
How to prevent it
- Implementation: When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array. Some examples of functions susceptible to this weakness in C include strcpy(), strncpy(), strcat(), strncat(), printf(), sprintf(), scanf() and sscanf().
References
Advisories
- packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html
- packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html
- packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.html
- packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.html
- packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
- seclists.org/fulldisclosure/2021/Feb/42
- seclists.org/fulldisclosure/2021/Jan/79
- seclists.org/fulldisclosure/2024/Feb/3
- openwall.com/lists/oss-security/2021/01/26/3
- openwall.com/lists/oss-security/2021/01/27/1
- openwall.com/lists/oss-security/2021/01/27/2
- openwall.com/lists/oss-security/2021/02/15/1
- openwall.com/lists/oss-security/2021/09/14/2
- kc.mcafee.com/corporate/index
- lists.debian.org/debian-lts-announce/2021/01/msg00022.html
- security.gentoo.org/glsa/202101-33
- security.netapp.com/advisory/ntap-20210128-0001
- security.netapp.com/advisory/ntap-20210128-0002
- support.apple.com/kb/HT212177
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sudo-privesc-…
- beyondtrust.com/blog/entry/security-advisory-privilege-management-for-unix-linux-pmu…
- debian.org/security/2021/dsa-4839
- kb.cert.org/vuls/id/794544
- openwall.com/lists/oss-security/2021/01/26/3
- oracle.com//security-alerts/cpujul2021.html
- oracle.com/security-alerts/cpuapr2022.html
- oracle.com/security-alerts/cpuoct2021.html
- synology.com/security/advisory/Synology_SA_21_02
- vicarius.io/vsociety/posts/sudoedit-pwned-cve-2021-3156
Exploits and evidence
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-q97c-p368-75c4 vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) | Medium | Same weakness, CWE-193 |
| GHSA-v859-c572-qh5p ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions | Medium | Same weakness, CWE-193 |
| GHSA-hwf3-r46v-5ggx ImageMagick: Information Disclosure when printing profiles with debug enabled | Low | Same weakness, CWE-193 |
| GHSA-4565-r4x7-hg8j Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation | Medium | Same weakness, CWE-193 |
| GHSA-jqq5-8px3-9m6m ImageMagick: Heap Buffer Over-Write in json and yaml encoder of a single byte due to incorrect fix | Medium | Same weakness, CWE-193 |
| GHSA-533m-3wf6-c33v ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder. | Medium | Same weakness, CWE-193 |
| GHSA-cr6r-hmj8-pr7r ImageMagick: Out-of-Bounds Read of a single byte in meta encoder | Medium | Same weakness, CWE-193 |
| GHSA-q8h3-jv9v-57qx ImageMagick has has an off-by-one origin validation in allows out-of-bounds read in morphology processing | Medium | Same weakness, CWE-193 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor