CVE-2021-3156: Sudo Heap-Based Buffer Overflow, actively exploited

Description

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Beyondtrust Privilege Management For Mac< 21.1.1

Beyondtrust Privilege Management For Unix/linux< 10.3.2-10

Mcafee Web Gateway10.0.4 · 8.2.17 · 9.2.8

Netapp Active Iq Unified Managerall versions

Netapp Cloud Backupall versions

Netapp Hci Management Nodeall versions

Netapp Oncommand Unified Manager Core Packageall versions

Netapp Ontap Select Deploy Administration Utilityall versions

Netapp Ontap Tools9

Netapp Solidfireall versions

Oracle Communications Performance Intelligence Center≥ 10.3.0.0.0 ≤ 10.3.0.2.1 · ≥ 10.4.0.1.0 ≤ 10.4.0.3.1

Oracle Tekelec Platform Distribution≥ 7.4.0 ≤ 7.7.1

Sudo≥ 1.8.2 < 1.8.32 · ≥ 1.9.0 < 1.9.5 · 1.9.5

Synology Diskstation Manager Unified Controller3.0

Debian Linux10.0 · 9.0

Fedoraproject Fedora32 · 33

Oracle Micros Compact Workstation 3 Firmware310

Oracle Micros Es400 Firmware≥ 400 ≤ 410

Oracle Micros Kitchen Display System Firmware210

Oracle Micros Workstation 5a Firmware5a

Oracle Micros Workstation 6 Firmware≥ 610 ≤ 655

Synology Diskstation Manager6.2

Synology Skynas Firmwareall versions

Synology Vs960hd Firmwareall versions

Remediation

Fixed in

Beyondtrust Privilege Management For Mac≥ 21.1.1

Beyondtrust Privilege Management For Unix/linux≥ 10.3.2-10

Sudo≥ 1.8.32

Patch & vendor advisories

References

http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.htmlExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2021/Feb/42Mailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2021/Jan/79ExploitMailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2024/Feb/3ExploitMailing ListThird Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10348Broken LinkThird Party Advisory
https://lists.debian.org/debian-lts-announce/2021/01/msg00022.htmlMailing ListThird Party Advisory

and 25 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2021-3156 being actively exploited?

Yes. CVE-2021-3156 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 6 Apr 2022.

How severe is CVE-2021-3156?

CVE-2021-3156 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 100.0% probability of exploitation.

Which products are affected by CVE-2021-3156?

Affected products include Beyondtrust Privilege Management For Mac, Beyondtrust Privilege Management For Unix/linux, Mcafee Web Gateway, Netapp Active Iq Unified Manager, Netapp Cloud Backup, and 19 more.

How do I fix CVE-2021-3156?

Upgrade affected software to a fixed version, for example Beyondtrust Privilege Management For Mac 21.1.1, Beyondtrust Privilege Management For Unix/linux 10.3.2-10, Sudo 1.8.32 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2021-3156 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo