CVE-2021-3156highunder attackCWE-193

CVE-2021-3156

Published 26 Jan 2021 · Updated 21 Oct 2025

Follow this CVE + Monitor Sudo + Monitor sudo

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.8epss 100%

from disclosure to weaponsame day

Published on NVDJan 26

1st PoCJan 26

metasploitJan 26

CISA KEV+435d

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Fixed

35 products (211 components)

Red Hat Enterprise Linux Server Optional (v. 7) · Red Hat Enterprise Linux Server Optional EUS (v. 7.6) · Red Hat Enterprise Linux Server Optional EUS (v. 7.7) · Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux BaseOS EUS (v. 8.1) · and others 30

fix ↗

Not affected

6 products (106 components) — because the vulnerable code is not present in the product

Red Hat Virtualization 4 Hypervisor for RHEL 8 · Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts · RHEL 8-based RHEV-H for RHEV 4 (build requirements) · RHEL 7-based RHEV-H for RHEV 4 (build requirements) · Red Hat Enterprise Linux 9 · and others 1

Action required by CISAfederal deadline: 2022-04-27

Apply updates per vendor instructions.

In short

Sudo has a flaw where a specially crafted command ending with a backslash can overflow memory and let an attacker gain root access. This affects older versions of Sudo and can be exploited through the sudoedit command.

Technical detail

An off-by-one error in Sudo versions before 1.9.5p2 leads to heap-based buffer overflow when processing sudoedit with the -s flag followed by arguments terminating in a backslash. This allows local privilege escalation to root; requires sudoedit functionality to be available to the user.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

public PoCs found — 182

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html http://packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.html http://packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.html http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html http://seclists.org/fulldisclosure/2021/Feb/42 http://seclists.org/fulldisclosure/2021/Jan/79 http://seclists.org/fulldisclosure/2024/Feb/3 https://kc.mcafee.com/corporate/index?page=content&id=SB10348 https://lists.debian.org/debian-lts-announce/2021/01/msg00022.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CALA5FTXIQBRRYUA2ZQNJXB6OQMAXEII/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LHXK6ICO5AYLGFK2TAX5MZKUXTUKWOJY/