CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2021-3156
High (7.8) in Sudo Sudo. In CISA KEV since 2022-04-06. EPSS 100% chance of exploitation in the next 30 days.
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
Severity
- EPSS
- 100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2022-04-06, due 2022-04-27
- CWE
- CWE-193
- Published
- Modified
- Record from
- the NVD, synced
Affected
- beyondtrust:privilege_management_for_mac
- beyondtrust:privilege_management_for_unix\/linux
- debian:debian_linux
- fedoraproject:fedora
- mcafee:web_gateway
- netapp:active_iq_unified_manager
- netapp:cloud_backup
- netapp:hci_management_node
- netapp:oncommand_unified_manager_core_package
- netapp:ontap_select_deploy_administration_utility
- netapp:ontap_tools
- netapp:solidfire
- oracle:communications_performance_intelligence_center
- oracle:micros_compact_workstation_3_firmware
- oracle:micros_es400_firmware
- oracle:micros_kitchen_display_system_firmware
- oracle:micros_workstation_5a_firmware
- oracle:micros_workstation_6_firmware
- oracle:tekelec_platform_distribution
- sudo_project:sudo
- synology:diskstation_manager
- synology:diskstation_manager_unified_controller
- synology:skynas_firmware
- synology:vs960hd_firmware
References
- http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html
- http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html
- http://packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.html
- http://packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.html
- http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html