CVE-2021-3156

CVSS 3.1 Score 7.8 of 10 (high)

Details

Published Jan 26, 2021
Updated: Jan 14, 2025
CWE ID 193

Summary

CVE-2021-3156 is a vulnerability affecting sudo versions prior to 1.9.5p2. This issue involves an off-by-one error in sudo's handling of command-line arguments, leading to a heap-based buffer overflow. An attacker can exploit this vulnerability by crafting a malicious command with a trailing backslash character when using the "sudoedit -s" command, resulting in privilege escalation to root level access.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Sudo Project Sudo
  • McAfee Web Gateway
  • Debian
  • Fedora Operating System
  • DiskStation Manager

Affected Vendors

  • Debian
  • Fedora Project
  • Synology
  • McAfee
  • BeyondTrust Software Corp

Advisories, Assessments, and Mitigations