CVE-2021-3156Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to…
- 7.8HighCVSS base score
- 100.0%Exploitation in 30 daysEPSS · top 0.1% of all CVEs
- YesKnown exploitedin CISA's KEV since 6 Apr 2022
- 3Public exploitsMetasploit, Nuclei and Exploit-DB
Description
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
Exploited in the wild
CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Sudo Heap-Based Buffer Overflow Vulnerability.
- Added
- 6 Apr 2022
- Fix due (US federal)
- 27 Apr 2022
- Used by ransomware
- Not known
Apply updates per vendor instructions.
ENISA's EU Vulnerability Database lists it as exploited, from CISA's KEV, since 6 Apr 2022.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. The public collections list a Metasploit module and 2 Exploit-DB entries for it. CISA's SSVC rates its exploitation: it is being exploited.
Show the exploits3
Metasploit modules1 module
- Sudo Heap-Based Buffer Overflow (Metasploit module) (opens in a new tab)
exploit/linux/local/sudo_baron_sameditRank excellentdisclosed 26 Jan 2021
Exploit-DB2 entries
- Sudo 1.9.5p1 - 'Baron Samedit ' Heap-Based Buffer Overflow Privilege Escalation (1) (Exploit-DB entry) (opens in a new tab)
EDB-ID 49521local, multiplepublished 3 Feb 2021Not verified
- Sudo 1.9.5p1 - 'Baron Samedit ' Heap-Based Buffer Overflow Privilege Escalation (2) (Exploit-DB entry) (opens in a new tab)
EDB-ID 49522local, multiplepublished 3 Feb 2021Not verified
Modules, templates and exploits as listed by the Metasploit Framework (BSD-3-Clause), ProjectDiscovery's Nuclei templates (MIT) and the Exploit Database (GPLv2), read once a day. Where the data comes from
Timeline
ID reserved
By mitre
- 11 days later
· 11 days later
Published
- 15 months later
· 15 months later
Added to CISA KEV
Known exploited in the wild
- 4 years later
· 4 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 100.0% · top 0.1% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: active · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
n/a
- affected n/a
References
References35
- [debian-lts-announce] 20210126 [SECURITY] [DLA 2534-1] sudo security update (opens in a new tab)mailing-listx_transferred
- 20210126 Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156) (opens in a new tab)mailing-listx_transferred
- [oss-security] 20210126 Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156) (opens in a new tab)mailing-listx_transferred
- GLSA-202101-33 (opens in a new tab)vendor-advisoryx_transferred
- DSA-4839 (opens in a new tab)vendor-advisoryx_transferred
- FEDORA-2021-2cb63d912a (opens in a new tab)vendor-advisoryx_transferred
- FEDORA-2021-8840cbdccd (opens in a new tab)vendor-advisoryx_transferred
- [oss-security] 20210127 Re: Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156) (opens in a new tab)mailing-listx_transferred
- [oss-security] 20210127 Re: Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156) (opens in a new tab)mailing-listx_transferred
- 20210129 Sudo Privilege Escalation Vulnerability Affecting Cisco Products: January 2021 (opens in a new tab)vendor-advisoryx_transferred
- VU#794544 (opens in a new tab)third-party-advisoryx_transferred
- 20210211 APPLE-SA-2021-02-09-1 macOS Big Sur 11.2.1, macOS Catalina 10.15.7 Supplemental Update, and macOS Mojave 10.14.6 Security Update 2021-002 (opens in a new tab)mailing-listx_transferred
- [oss-security] 20210215 Re: sudo: Ineffective NO_ROOT_MAILER and Baron Samedit (opens in a new tab)mailing-listx_transferred
- https://www.oracle.com//security-alerts/cpujul2021.html (opens in a new tab)x_transferred
- https://www.sudo.ws/stable.html#1.9.5p2 (opens in a new tab)x_transferred
- https://www.openwall.com/lists/oss-security/2021/01/26/3 (opens in a new tab)x_transferred
- http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html (opens in a new tab)x_transferred
- https://security.netapp.com/advisory/ntap-20210128-0002/ (opens in a new tab)x_transferred
- https://security.netapp.com/advisory/ntap-20210128-0001/ (opens in a new tab)x_transferred
- http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html (opens in a new tab)x_transferred
- http://packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.html (opens in a new tab)x_transferred
- http://packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.html (opens in a new tab)x_transferred
- https://support.apple.com/kb/HT212177 (opens in a new tab)x_transferred
- https://kc.mcafee.com/corporate/index?page=content&id=SB10348 (opens in a new tab)x_transferred
- https://www.beyondtrust.com/blog/entry/security-advisory-privilege-management-for-unix-linux-pmul-basic-and-privilege-management-for-mac-pmm-affected-by-sudo-vulnerability (opens in a new tab)x_transferred
- https://www.synology.com/security/advisory/Synology_SA_21_02 (opens in a new tab)x_transferred
- [oss-security] 20210914 Re: Oracle Solaris membership in the distros list (opens in a new tab)mailing-listx_transferred
- https://www.oracle.com/security-alerts/cpuoct2021.html (opens in a new tab)x_transferred
- https://www.oracle.com/security-alerts/cpuapr2022.html (opens in a new tab)x_transferred
- [oss-security] 20240130 Re: CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog() (opens in a new tab)mailing-listx_transferred
- [oss-security] 20240130 CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog() (opens in a new tab)mailing-listx_transferred
- http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html (opens in a new tab)x_transferred
- 20240204 CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog() (opens in a new tab)mailing-listx_transferred
- https://www.vicarius.io/vsociety/posts/sudoedit-pwned-cve-2021-3156 (opens in a new tab)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3156 (opens in a new tab)government-resource
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- CISA KEV catalog (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2021-26500 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2021-3156)Record last updated .