CVE-2021-3156: Sudo Heap-Based Buffer Overflow Vulnerability

CVSS: 7.8v3.1HighKEVAnalyzed

AliasesALPINE-CVE-2021-3156MGASA-2021-0056SUSE-SU-2021:0928-1+21 more

Published 26-01-2021Last modified 21-10-2025

Vulnerability summary

CVE-2021-3156 is a high (CVSS 7.8) Off-by-one Error vulnerability in Sudo. It is known to be exploited: CISA lists it, first on 06-04-2022. EPSS estimates a 99.96% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 15 public exploits are recorded.

Overall risk

85/100

0100

Critical · default modelHow is this calculated?

CVSS score

7.8/10

010

High · v3.1 (CVE.org)

EPSS score

99.96%

0%100%

Critical · -0.01 pp in 30 days

KEVListedCISA

RansomwareNone recordedNo known use recorded

Public exploits15reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 10 · Related 8

OPENSUSE-SU-2021:0169-1 OPENSUSE-SU-2021:0170-1 OPENSUSE-SU-2024:11413-1 RHSA-2021:0395 RHSA-2021:0401 SUSE-SU-2021:0225-1+4 more

Timeline

26-01-2021
PublishedVulnerability first disclosed.
06-04-2022
Added to CISA KEVSudo Heap-Based Buffer Overflow Vulnerability
27-04-2022
CISA remediation dueApply updates per vendor instructions.
21-10-2025
Last modifiedVulnerability information updated.

Description

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

CVSS metrics

7 scores · 6 sources · 2 versions

v3.17.8v2.07.2

EPSS trend

Probability

99.96%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

-0.01 pp

From 99.97% on 18-09-2026

18-09-202618-10-2026

EPSS score

99.96%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 06-04-2022
Federal due date: 27-04-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2021-3156

Public exploits

15 found

referenceUnverified
Exploit Reference (seclists.org)
Maturity: unknown
referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown
referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown

Show all 15 exploits

referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (seclists.org)
Maturity: unknown
referenceUnverified
Exploit Reference (vicarius.io)
Maturity: unknown
exploit-databaselocalmultipleUnverified
Sudo 1.9.5p1 - 'Baron Samedit ' Heap-Based Buffer Overflow Privilege Escalation (1)
Maturity: poc
exploit-databaselocalmultipleUnverified
Sudo 1.9.5p1 - 'Baron Samedit ' Heap-Based Buffer Overflow Privilege Escalation (2)
Maturity: poc
MetasploitremoteVerified
Sudo Heap-Based Buffer Overflow
exploit/linux/local/sudo_baron_samedit
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-193Off-by-one ErrorA product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Affected systems

Suse34 products

sudo&distro=HPE Helion OpenStack 8< 1.8.20p2-3.23.1
sudo&distro=SUSE Enterprise Storage 6< 1.8.22-4.18.1
sudo&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 1.8.22-4.18.1
sudo&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.8.22-4.18.1
sudo&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 1.8.22-4.18.1

sudo&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 1.8.22-4.18.1
sudo&distro=SUSE Linux Enterprise Micro 5.0< 1.8.22-4.18.1
sudo&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 1.8.22-4.18.1
sudo&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 1.8.10p3-10.32.1 | < 1.8.10p3-10.35.1
sudo&distro=SUSE Linux Enterprise Server 12 SP2-LTSS< 1.8.10p3-10.32.1
sudo&distro=SUSE Linux Enterprise Server 12 SP3-BCL< 1.8.20p2-3.23.1
sudo&distro=SUSE Linux Enterprise Server 12 SP3-LTSS< 1.8.20p2-3.23.1
sudo&distro=SUSE Linux Enterprise Server 12 SP4-LTSS< 1.8.20p2-3.23.1
sudo&distro=SUSE Linux Enterprise Server 12 SP5< 1.8.27-4.15.1
sudo&distro=SUSE Linux Enterprise Server 12 SP5-LTSS< 1.8.27-4.51.1
sudo&distro=SUSE Linux Enterprise Server 15 SP1-BCL< 1.8.22-4.18.1
sudo&distro=SUSE Linux Enterprise Server 15 SP1-LTSS< 1.8.22-4.18.1
sudo&distro=SUSE Linux Enterprise Server 15-LTSS< 1.8.22-4.18.1
sudo&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2< 1.8.10p3-10.32.1
sudo&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3< 1.8.20p2-3.23.1
sudo&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 1.8.20p2-3.23.1
sudo&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 1.8.27-4.15.1
sudo&distro=SUSE Linux Enterprise Server for SAP Applications 15< 1.8.22-4.18.1
sudo&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1< 1.8.22-4.18.1
sudo&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5< 1.8.27-4.51.1
sudo&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 1.8.27-4.15.1
sudo&distro=SUSE Manager Proxy 4.0< 1.8.22-4.18.1
sudo&distro=SUSE Manager Retail Branch Server 4.0< 1.8.22-4.18.1
sudo&distro=SUSE Manager Server 4.0< 1.8.22-4.18.1
sudo&distro=SUSE OpenStack Cloud 7< 1.8.10p3-10.32.1
sudo&distro=SUSE OpenStack Cloud 8< 1.8.20p2-3.23.1
sudo&distro=SUSE OpenStack Cloud 9< 1.8.20p2-3.23.1
sudo&distro=SUSE OpenStack Cloud Crowbar 8< 1.8.20p2-3.23.1
sudo&distro=SUSE OpenStack Cloud Crowbar 9< 1.8.20p2-3.23.1

Show all 34

Netapp7 products

Show all 7

Oracle7 products

communications_performance_intelligence_center≥ 10.3.0.0.0, ≤ 10.3.0.2.1 | ≥ 10.4.0.1.0, ≤ 10.4.0.3.1
micros_compact_workstation_3_firmware310
micros_es400_firmware≥ 400, ≤ 410
micros_kitchen_display_system_firmware210
micros_workstation_5a_firmware5a

Show all 7

Redhat4 products

sudo< 0:1.8.29-6.el8_3.1 | < 0:1.8.29-5.el8_2.1 | < 0:1.8.25p1-8.el8_1.2 | < 0:1.8.23-10.el7_9.1 | < 0:1.8.23-4.el7_7.3 | < 0:1.8.23-3.el7_6.2 | < 0:1.8.19p2-12.el7_4.2 | < 0:1.8.6p7-23.el7_3.3 | < 0:1.8.6p7-17.el7_2.3 | < 0:1.8.6p3-29.el6_10.4
sudo-debuginfo< 0:1.8.29-6.el8_3.1 | < 0:1.8.29-5.el8_2.1 | < 0:1.8.25p1-8.el8_1.2 | < 0:1.8.23-10.el7_9.1 | < 0:1.8.23-4.el7_7.3 | < 0:1.8.23-3.el7_6.2 | < 0:1.8.19p2-12.el7_4.2 | < 0:1.8.6p7-23.el7_3.3 | < 0:1.8.6p7-17.el7_2.3 | < 0:1.8.6p3-29.el6_10.4
sudo-debugsource< 0:1.8.29-6.el8_3.1 | < 0:1.8.29-5.el8_2.1 | < 0:1.8.25p1-8.el8_1.2
sudo-devel< 0:1.8.23-10.el7_9.1 | < 0:1.8.23-4.el7_7.3 | < 0:1.8.23-3.el7_6.2 | < 0:1.8.19p2-12.el7_4.2 | < 0:1.8.6p7-23.el7_3.3 | < 0:1.8.6p7-17.el7_2.3 | < 0:1.8.6p3-29.el6_10.4

Synology4 products

Beyondtrust2 products

privilege_management_for_mac< 21.1.1
privilege_management_for_unix\/linux< 10.3.2-10

Debian2 products

sudo< 1.9.5p1-1.1 | < 1.8.27-1+deb10u3 | < 1.8.19p1-2.1+deb9u3
debian_linuxEOL9.0 | 10.0

Alpine1 product

sudo≥ 1.8.2, < 1.9.5p2-r0 | ≥ 1.8.2, < 1.8.31-r1

Fedoraproject1 product

fedoraEOL32 | 33

Mageia1 product

sudo< 1.9.5p2-1.mga7

Mcafee1 product

web_gateway8.2.17 | 9.2.8 | 10.0.4

Opensuse1 product

sudo&distro=openSUSE Leap 15.2< 1.8.22-lp152.8.9.1

Sudo_project1 product

sudo≥ 1.8.2, < 1.8.32 | ≥ 1.9.0, < 1.9.5 | 1.9.5 | 1.9.5:patch1

Ubuntu1 product

sudo< 1.8.9p5-1ubuntu1.5+esm6 | < 1.8.16-0ubuntu1.10 | < 1.8.21p2-3ubuntu1.4 | < 1.8.31-1ubuntu1.2

14 vendors · 67 products

References

82 links

lists.debian.org/debian-lts-announce/2021/01/msg00022.htmlMailing ListThird Party Advisory
seclists.org/fulldisclosure/2021/Jan/79Mailing ListExploitThird Party Advisory
www.openwall.com/lists/oss-security/2021/01/26/3Mailing ListExploitThird Party Advisory
security.gentoo.org/glsa/202101-33Vendor AdvisoryThird Party Advisory
www.debian.org/security/2021/dsa-4839Vendor AdvisoryThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryMailing ListRelease Notes
lists.fedoraproject.org/archives/…Vendor AdvisoryMailing ListRelease Notes
www.openwall.com/lists/oss-security/2021/01/27/1Mailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2021/01/27/2Mailing ListThird Party Advisory
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sudo-privesc-jan2021-qnYQfcMVendor AdvisoryThird Party Advisory

Show all 82 references

www.kb.cert.org/vuls/id/794544Third Party AdvisoryUS Government Resource
seclists.org/fulldisclosure/2021/Feb/42Mailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2021/02/15/1Mailing ListExploitThird Party Advisory
www.oracle.com//security-alerts/cpujul2021.htmlPatchThird Party Advisory
www.sudo.ws/stable.htmlRelease Notes
www.openwall.com/lists/oss-security/2021/01/26/3ExploitMailing ListThird Party Advisory
packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.htmlExploitThird Party AdvisoryVDB Entry
security.netapp.com/advisory/ntap-20210128-0002/Third Party Advisory
security.netapp.com/advisory/ntap-20210128-0001/Third Party Advisory
packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.htmlExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.htmlExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.htmlExploitThird Party AdvisoryVDB Entry
support.apple.com/kb/HT212177Third Party Advisory
kc.mcafee.com/corporate/index?page=content&id=SB10348Broken LinkThird Party Advisory
www.beyondtrust.com/blog/…Third Party Advisory
www.synology.com/security/advisory/Synology_SA_21_02Third Party Advisory
www.openwall.com/lists/oss-security/2021/09/14/2Mailing ListPatchThird Party Advisory
www.oracle.com/security-alerts/cpuoct2021.htmlPatchThird Party Advisory
www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
www.openwall.com/lists/oss-security/2024/01/30/8Mailing List
www.openwall.com/lists/oss-security/2024/01/30/6Mailing ListExploit
packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.htmlExploitThird Party AdvisoryVDB Entry
seclists.org/fulldisclosure/2024/Feb/3Mailing ListExploitThird Party Advisory
www.vicarius.io/vsociety/posts/sudoedit-pwned-cve-2021-3156ExploitThird Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3156Government ResourceUS Government Resource
security.alpinelinux.org/vuln/CVE-2021-3156Advisory
advisories.mageia.org/MGASA-2021-0056.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=28230REPORT
www.sudo.ws/alerts/unescape_overflow.htmlWEBARTICLE
www.suse.com/support/update/announcement/2021/suse-su-20210928-1/Advisory
bugzilla.suse.com/1181090REPORT
www.suse.com/security/cve/CVE-2021-3156WEB
www.suse.com/support/update/announcement/2021/suse-su-20211267-1/Advisory
bugzilla.suse.com/1183936REPORT
www.suse.com/support/update/announcement/2021/suse-su-20211273-1/Advisory
www.suse.com/support/update/announcement/2021/suse-su-20211274-1/Advisory
www.suse.com/support/update/announcement/2021/suse-su-20211275-1/Advisory
www.suse.com/support/update/announcement/2024/suse-su-20244389-1/Advisory
bugzilla.suse.com/1234371REPORT
access.redhat.com/errata/RHSA-2021:0218Advisory
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/security/vulnerabilities/RHSB-2021-002ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1917684REPORT
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0218.jsonAdvisory
access.redhat.com/security/cve/CVE-2021-3156REPORT
www.cve.org/CVERecord?id=CVE-2021-3156AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2021-3156Advisory
www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txtARTICLE
www.cisa.gov/known-exploited-vulnerabilities-catalogARTICLEREPORT
access.redhat.com/errata/RHSA-2021:0219Advisory
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0219.jsonAdvisory
access.redhat.com/errata/RHSA-2021:0220Advisory
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0220.jsonAdvisory
access.redhat.com/errata/RHSA-2021:0221Advisory
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0221.jsonAdvisory
access.redhat.com/errata/RHSA-2021:0222Advisory
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0222.jsonAdvisory
access.redhat.com/errata/RHSA-2021:0223Advisory
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0223.jsonAdvisory
access.redhat.com/errata/RHSA-2021:0224Advisory
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0224.jsonAdvisory
access.redhat.com/errata/RHSA-2021:0225Advisory
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0225.jsonAdvisory
access.redhat.com/errata/RHSA-2021:0226Advisory
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0226.jsonAdvisory
access.redhat.com/errata/RHSA-2021:0227Advisory
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0227.jsonAdvisory
ubuntu.com/security/CVE-2021-3156REPORT
ubuntu.com/security/notices/USN-4705-1Advisory
ubuntu.com/security/notices/USN-4705-2Advisory
security-tracker.debian.org/tracker/CVE-2021-3156Advisory
lists.opensuse.org/archives/…Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities