Description
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sudo | 1.9.5p1-1.1 | — |
| Debian 13 | sudo | 1.9.5p1-1.1 | — |
| Debian 12 | sudo | 1.9.5p1-1.1 | — |
| Debian 10 | sudo | 1.8.27-1+deb10u3 | DSA-4839-1 |
| Debian 9 | sudo | 1.8.19p1-2.1+deb9u3 | DLA-2534-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | sudo | 1.8.31-1ubuntu1.2 | USN-4705-1 |
| Ubuntu 18.04 LTS | sudo | 1.8.21p2-3ubuntu1.4 | USN-4705-1 |
| Ubuntu 16.04 LTS | sudo | 1.8.16-0ubuntu1.10 | USN-4705-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | sudo | 1.8.9p5-1ubuntu1.5+esm6 | USN-4705-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | sudo | 1.8.29-6.el8_3.1 | RHSA-2021:0218 |
| RHEL 7 | redhat-virtualization-host +1 | 4.3.13-20210127.0.el7_9 | RHSA-2021:0395 |
| RHEL 7 | sudo +1 | 1.8.23-10.el7_9.1 | RHSA-2021:0221 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Hypervisor 4 | redhat-virtualization-host +1 | 4.4.4-20210201.0.el8_3 | RHSA-2021:0401 |
| RHEL 8.2 EUS | sudo | 1.8.29-5.el8_2.1 | RHSA-2021:0219 |
| RHEL 8.1 EUS | sudo | 1.8.25p1-8.el8_1.2 | RHSA-2021:0220 |
| RHEL 7.7 EUS | sudo +1 | 1.8.23-4.el7_7.3 | RHSA-2021:0222 |
| RHEL 7.6 EUS | sudo +1 | 1.8.23-3.el7_6.2 | RHSA-2021:0223 |
| RHEL 7.4 TUS | sudo +1 | 1.8.19p2-12.el7_4.2 | RHSA-2021:0224 |
| RHEL 7.4 E4S | sudo +1 | 1.8.19p2-12.el7_4.2 | RHSA-2021:0224 |
| RHEL 7.4 AUS | sudo +1 | 1.8.19p2-12.el7_4.2 | RHSA-2021:0224 |
| RHEL 7.3 AUS | sudo +1 | 1.8.6p7-23.el7_3.3 | RHSA-2021:0225 |
| RHEL 7.2 AUS | sudo +1 | 1.8.6p7-17.el7_2.3 | RHSA-2021:0226 |
| RHEL 6 ELS | sudo +1 | 1.8.6p3-29.el6_10.4 | RHSA-2021:0227 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | sudo | 1.8.22-4.15.1 | SUSE-SU-2021:1275-1, SUSE-SU-2021:0227-1 |
| SLES 15 SP1 | sudo | 1.8.22-4.15.1 | SUSE-SU-2021:1275-1, SUSE-SU-2021:0227-1 |
| SLES 15 | sudo | 1.8.22-4.15.1 | SUSE-SU-2021:1275-1, SUSE-SU-2021:0227-1 |
| SLES 12 SP5 | sudo | 1.8.27-4.6.1 | SUSE-SU-2024:4389-1, SUSE-SU-2021:1274-1, SUSE-SU-2021:0225-1 |
| SLES 12 SP4 | sudo | 1.8.20p2-3.20.1 | SUSE-SU-2021:1273-1, SUSE-SU-2021:0226-1 |
Show 22 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | sudo | 1.8.20p2-3.20.1 | SUSE-SU-2021:1273-1, SUSE-SU-2021:0226-1 |
| SLES 12 SP2 | sudo | 1.8.10p3-10.29.1 | SUSE-SU-2021:1267-1, SUSE-SU-2021:0928-1, SUSE-SU-2021:0232-1 |
| SLES for SAP 15 SP1 | sudo | 1.8.22-4.15.1 | SUSE-SU-2021:1275-1, SUSE-SU-2021:0227-1 |
| SLES for SAP 15 | sudo | 1.8.22-4.15.1 | SUSE-SU-2021:1275-1, SUSE-SU-2021:0227-1 |
| SLES for SAP 12 SP5 | sudo | 1.8.27-4.6.1 | SUSE-SU-2021:1274-1, SUSE-SU-2021:0225-1 |
| SLES for SAP 12 SP4 | sudo | 1.8.20p2-3.20.1 | SUSE-SU-2021:1273-1, SUSE-SU-2021:0226-1 |
| SLES for SAP 12 SP3 | sudo | 1.8.20p2-3.20.1 | SUSE-SU-2021:1273-1, SUSE-SU-2021:0226-1 |
| SLES for SAP 12 SP2 | sudo | 1.8.10p3-10.29.1 | SUSE-SU-2021:0928-1, SUSE-SU-2021:0232-1 |
| SLE Micro 5.0 | sudo | 1.8.22-4.18.1 | SUSE-SU-2021:1275-1 |
| SLE HPC 15 SP1 | sudo | 1.8.22-4.15.1 | SUSE-SU-2021:1275-1, SUSE-SU-2021:0227-1 |
| SLE HPC 15 | sudo | 1.8.22-4.15.1 | SUSE-SU-2021:1275-1, SUSE-SU-2021:0227-1 |
| SUSE OpenStack Cloud Crowbar 9 | sudo | 1.8.20p2-3.20.1 | SUSE-SU-2021:1273-1, SUSE-SU-2021:0226-1 |
| SUSE OpenStack Cloud Crowbar 8 | sudo | 1.8.20p2-3.20.1 | SUSE-SU-2021:1273-1, SUSE-SU-2021:0226-1 |
| SUSE OpenStack Cloud 9 | sudo | 1.8.20p2-3.20.1 | SUSE-SU-2021:1273-1, SUSE-SU-2021:0226-1 |
| SUSE OpenStack Cloud 8 | sudo | 1.8.20p2-3.20.1 | SUSE-SU-2021:1273-1, SUSE-SU-2021:0226-1 |
| SUSE OpenStack Cloud 7 | sudo | 1.8.10p3-10.29.1 | SUSE-SU-2021:0928-1, SUSE-SU-2021:0232-1 |
| SUSE Manager Server 4.0 | sudo | 1.8.22-4.15.1 | SUSE-SU-2021:1275-1, SUSE-SU-2021:0227-1 |
| SUSE Manager Retail Branch Server 4.0 | sudo | 1.8.22-4.15.1 | SUSE-SU-2021:1275-1, SUSE-SU-2021:0227-1 |
| SUSE Manager Proxy 4.0 | sudo | 1.8.22-4.15.1 | SUSE-SU-2021:1275-1, SUSE-SU-2021:0227-1 |
| SUSE HPE Helion OpenStack 8 | sudo | 1.8.20p2-3.20.1 | SUSE-SU-2021:1273-1, SUSE-SU-2021:0226-1 |
| SUSE Enterprise Storage 6 | sudo | 1.8.22-4.15.1 | SUSE-SU-2021:1275-1, SUSE-SU-2021:0227-1 |
| SUSE Enterprise Storage 5 | sudo | 1.8.20p2-3.20.1 | SUSE-SU-2021:0226-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sudo | 1.9.7p2-1.4 | openSUSE-SU-2024:11413-1 |
| openSUSE Leap 15.2 | sudo | 1.8.22-lp152.8.6.1 | openSUSE-SU-2021:0602-1, openSUSE-SU-2021:0170-1 |
| openSUSE Leap 15.1 | sudo | 1.8.22-lp151.5.12.1 | openSUSE-SU-2021:0169-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | sudo | 1.9.5_p2-r0 | — |
| Alpine v3.23 | sudo | 1.9.5_p2-r0 | — |
| Alpine v3.22 | sudo | 1.9.5_p2-r0 | — |
| Alpine v3.21 | sudo | 1.9.5_p2-r0 | — |
| Alpine v3.20 | sudo | 1.9.5_p2-r0 | — |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | sudo | 1.9.5_p2-r0 | — |
| Alpine v3.18 | sudo | 1.9.5p2-r0 | — |
| Alpine v3.17 | sudo | 1.9.5p2-r0 | — |
| Alpine v3.16 | sudo | 1.9.5p2-r0 | — |
| Alpine v3.15 | sudo | 1.9.5p2-r0 | — |
| Alpine v3.14 | sudo | 1.9.5p2-r0 | — |
| Alpine v3.13 | sudo | 1.9.5p2-r0 | — |
| Alpine v3.12 | sudo | 1.9.5p2-r0 | — |
| Alpine v3.11 | sudo | 1.8.31-r1 | — |
| Alpine v3.10 | sudo | 1.9.5p2-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | sudo +1 | 1.8.23-4.amzn2.2.1 | ALAS2-2021-1590 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | sudo | 1.8.29-6.el8_3.1 | ELSA-2021-0218 |
| Oracle Linux 7 | sudo +1 | 1.8.23-10.el7_9.1 | ELSA-2021-0221 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Sudo Heap-Based Buffer Overflow
exploit/linux/local/sudo_baron_samedit
Exploit-DB 2
- Sudo 1.9.5p1 - 'Baron Samedit ' Heap-Based Buffer Overflow Privilege Escalation (1) EDB-49521 · local · Feb 3, 2021
- Sudo 1.9.5p1 - 'Baron Samedit ' Heap-Based Buffer Overflow Privilege Escalation (2) EDB-49522 · local · Feb 3, 2021
GitHub 90 repositories · most starred shown
-
blasty/CVE-2021-3156 ★ 1,032 · Jan 30, 2021
-
worawit/CVE-2021-3156 ★ 812 · Mar 15, 2021
Sudo Baron Samedit Exploit
-
stong/CVE-2021-3156 ★ 429 · Jan 30, 2021
PoC for CVE-2021-3156 (sudo heap overflow)
-
LiveOverflow/pwnedit ★ 226 · Apr 29, 2021
CVE-2021-3156 - Sudo Baron Samedit
-
Rvn0xsy/CVE-2021-3156-plus ★ 204 · Feb 9, 2021
CVE-2021-3156非交互式执行命令
-
CptGibbon/CVE-2021-3156 ★ 158 · Feb 3, 2021
Root shell PoC for CVE-2021-3156
-
reverse-ex/CVE-2021-3156 ★ 112 · Jan 27, 2021
CVE-2021-3156
-
0x4ndy/clif ★ 100 · Nov 28, 2022
clif is a command-line interface (CLI) application fuzzer, pretty much what wfuzz or ffuf are for web. It was inspired by sudo vulnerability CVE-2021-3156 and the fact that for some reasons, Google's…
-
0xdevil/CVE-2021-3156 ★ 51 · Feb 8, 2021
CVE-2021-3156: Sudo heap overflow exploit for Debian 10
-
mbcrump/CVE-2021-3156 ★ 38 · Jan 29, 2021
Notes regarding CVE-2021-3156: Heap-Based Buffer Overflow in Sudo
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 41
- RHSA-2021:0401 Red Hat Security Advisory: Red Hat Virtualization Host security bug fix and enhancement update [ovirt-4.4.4] Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0395 Red Hat Security Advisory: RHV-H security, bug fix, enhancement update (redhat-virtualization-host) 4.3.13 Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0226 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0227 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0224 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0225 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0222 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0223 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0221 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0220 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0219 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0218 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-4705-1 sudo vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-4839-1 sudo - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2534-1 sudo - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4705-2 sudo vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2021:0169-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0928-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1275-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1274-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0602-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0226-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0225-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0170-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1267-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11413-1 sudo-1.9.7p2-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1273-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0227-1 Security update for sudo SUSE / openSUSE Security Updates · Feb 4, 2026
- VDE-2021-011 TRUMPF Laser GmbH: TruControl 2.14.0 to 3.14.0 affected by recent sudo vulnerability CERT@VDE · Feb 2, 2026
- WID-SEC-2023-0066 sudo: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Oct 1, 2025
- SUSE-SU-2024:4389-1 Security update for sudo SUSE / openSUSE Security Updates · May 2, 2025
- SUSE-SU-2021:0232-1 Security update for sudo SUSE / openSUSE Security Updates · May 2, 2025
- ICSA-22-256-01 Hitachi Energy TXpert Hub CoreTec 4 Sudo Vulnerability CISA ICS & IT advisories · Sep 13, 2022
- ICSA-21-334-04 Johnson Controls CEM Systems AC2000 CISA ICS & IT advisories · Nov 30, 2021
- ICSA-21-245-01 Johnson Controls Sensormatic Electronics Illustra CISA ICS & IT advisories · Sep 2, 2021
- ICSA-21-147-02 Johnson Controls Sensormatic Electronics VideoEdge CISA ICS & IT advisories · May 27, 2021
- ICSA-21-133-02 Johnson Controls Sensormatic Tyco AI CISA ICS & IT advisories · May 13, 2021
- ICSA-21-119-03 Johnson Controls Exacq Technologies exacqVision CISA ICS & IT advisories · Apr 29, 2021
- ELSA-2021-0218 Important: sudo security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 27, 2021
- ELSA-2021-0221 Important: sudo security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 27, 2021
- ALAS2-2021-1590 Important: sudo security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 26, 2021
References
- [debian-lts-announce] 20210126 [SECURITY] [DLA 2534-1] sudo security update mailing-list
- 20210126 Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156) mailing-list
- [oss-security] 20210126 Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156) mailing-list
- GLSA-202101-33 vendor-advisory
- DSA-4839 vendor-advisory
- FEDORA-2021-2cb63d912a vendor-advisory
- FEDORA-2021-8840cbdccd vendor-advisory
- [oss-security] 20210127 Re: Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156) mailing-list
- [oss-security] 20210127 Re: Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156) mailing-list
- 20210129 Sudo Privilege Escalation Vulnerability Affecting Cisco Products: January 2021 vendor-advisory
- VU#794544 third-party-advisory
- 20210211 APPLE-SA-2021-02-09-1 macOS Big Sur 11.2.1, macOS Catalina 10.15.7 Supplemental Update, and macOS Mojave 10.14.6 Security Update 2021-002 mailing-list
- [oss-security] 20210215 Re: sudo: Ineffective NO_ROOT_MAILER and Baron Samedit mailing-list
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.sudo.ws/stable.html#1.9.5p2
- https://www.openwall.com/lists/oss-security/2021/01/26/3
- http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html
- https://security.netapp.com/advisory/ntap-20210128-0002/
- https://security.netapp.com/advisory/ntap-20210128-0001/
- http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html
- http://packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.html
- http://packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.html
- https://support.apple.com/kb/HT212177
- https://kc.mcafee.com/corporate/index?page=content&id=SB10348
- https://www.beyondtrust.com/blog/entry/security-advisory-privilege-management-for-unix-linux-pmul-basic-and-privilege-management-for-mac-pmm-affected-by-sudo-vulnerability
- https://www.synology.com/security/advisory/Synology_SA_21_02
- [oss-security] 20210914 Re: Oracle Solaris membership in the distros list mailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- [oss-security] 20240130 Re: CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog() mailing-list
- [oss-security] 20240130 CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog() mailing-list
- http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
- 20240204 CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog() mailing-list
- https://www.vicarius.io/vsociety/posts/sudoedit-pwned-cve-2021-3156