CVE-2021-3156

CVE-2021-3156 is a high-severity (CVSS 7.8) vulnerability in Sudo Sudo. CISA added it to the Known Exploited Vulnerabilities catalog on April 6, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 27, 2022. CISA does not currently list it as used in ransomware campaigns. Sudo has 2 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html
• http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html
• http://packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.html
• http://packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.html
• http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
• http://seclists.org/fulldisclosure/2021/Feb/42
• http://seclists.org/fulldisclosure/2021/Jan/79
• http://seclists.org/fulldisclosure/2024/Feb/3