Sudo · Sudo
CVE-2021-3156
Sudo Heap-Based Buffer Overflow Vulnerability
Exploited in attacks
High 7.8 Attack chance: >99.9%
What it is
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
CISA: Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: April 27, 2022
- Added to the CISA list
- April 6, 2022
- Published
- January 26, 2021
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- >99.9% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-122 CWE-193
- More details
- NVD · CVE.org · CISA
All references (20)
- https://security.gentoo.org/glsa/202101-33
- https://www.debian.org/security/2021/dsa-4839
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LHXK6ICO5AYL…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CALA5FTXIQBR…
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sudo-privesc-jan2021-qnYQfcM
- https://lists.debian.org/debian-lts-announce/2021/01/msg00022.html
- http://seclists.org/fulldisclosure/2021/Jan/79
- http://www.openwall.com/lists/oss-security/2021/01/26/3
- http://www.openwall.com/lists/oss-security/2021/01/27/1
- http://www.openwall.com/lists/oss-security/2021/01/27/2
- https://www.kb.cert.org/vuls/id/794544
- http://seclists.org/fulldisclosure/2021/Feb/42
- http://www.openwall.com/lists/oss-security/2021/02/15/1
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.sudo.ws/stable.html#1.9.5p2
- https://www.openwall.com/lists/oss-security/2021/01/26/3
- http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html
- https://security.netapp.com/advisory/ntap-20210128-0002/
- https://security.netapp.com/advisory/ntap-20210128-0001/
- http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html
More exploited flaws from Sudo
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 29, 2025 | Inclusion of Functionality from Untrusted Control Sphere | Sudo | Critical 9.3 | 55% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.