Read the docs
TI-2021-02242 Aliases CVE-2021-3156GHSA-w5vh-2923-gp5c

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer…

Priority CRITICAL 93Exploited in the wildCWE-193Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-193 and the CVSS impact.

Summary

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

Why it matters now

Exploitation Active In CISA KEV since 2022-04-06CISA due date 2022-04-27
EPSS 0.99962 99th percentileScored 2026-11-08
Public exploit Yes 12 exploit referencesTagged by NVD
Fix Fixed Red Hat: 12 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 37

CPEVersionsRoleVendor
cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*1.8.2 to before 1.8.32; 1.9.0 to before 1.9.5VulnerableSudo project
cpe:2.3:a:sudo_project:sudo:1.9.5:-:*:*:*:*:*:*1.9.5VulnerableSudo project
cpe:2.3:a:sudo_project:sudo:1.9.5:patch1:*:*:*:*:*:*1.9.5 patch1VulnerableSudo project
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:* Versions 1.8.2 to before 1.8.32; 1.9.0 to before 1.9.5 Vulnerable ·Sudo project
  • cpe:2.3:a:sudo_project:sudo:1.9.5:-:*:*:*:*:*:* Versions 1.9.5 Vulnerable ·Sudo project
  • cpe:2.3:a:sudo_project:sudo:1.9.5:patch1:*:*:*:*:*:* Versions 1.9.5 patch1 Vulnerable ·Sudo project
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 27 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:netapp:oncommand_unified_manager_core_package:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*9VulnerableNetApp
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:mcafee:web_gateway:8.2.17:*:*:*:*:*:*:*8.2.17VulnerableMcAfee
cpe:2.3:a:mcafee:web_gateway:9.2.8:*:*:*:*:*:*:*9.2.8VulnerableMcAfee
cpe:2.3:a:mcafee:web_gateway:10.0.4:*:*:*:*:*:*:*10.0.4VulnerableMcAfee
cpe:2.3:a:synology:diskstation_manager_unified_controller:3.0:*:*:*:*:*:*:*3.0VulnerableSynology
cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:*6.2VulnerableSynology
cpe:2.3:o:synology:skynas_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableSynology
cpe:2.3:h:synology:skynas:-:*:*:*:*:*:*:*not specified by NVDRunning onSynology
cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableSynology
cpe:2.3:h:synology:vs960hd:-:*:*:*:*:*:*:*not specified by NVDRunning onSynology
cpe:2.3:a:beyondtrust:privilege_management_for_mac:*:*:*:*:*:*:*:*before 21.1.1VulnerableBeyondTrust
cpe:2.3:a:beyondtrust:privilege_management_for_unix\/linux:*:*:*:*:basic:*:*:*before 10.3.2-10VulnerableBeyondTrust
cpe:2.3:o:oracle:micros_compact_workstation_3_firmware:310:*:*:*:*:*:*:*310VulnerableOracle
cpe:2.3:h:oracle:micros_compact_workstation_3:-:*:*:*:*:*:*:*not specified by NVDRunning onOracle
cpe:2.3:o:oracle:micros_es400_firmware:*:*:*:*:*:*:*:*400 – 410VulnerableOracle
cpe:2.3:h:oracle:micros_es400:-:*:*:*:*:*:*:*not specified by NVDRunning onOracle
cpe:2.3:o:oracle:micros_kitchen_display_system_firmware:210:*:*:*:*:*:*:*210VulnerableOracle
cpe:2.3:h:oracle:micros_kitchen_display_system:-:*:*:*:*:*:*:*not specified by NVDRunning onOracle
cpe:2.3:o:oracle:micros_workstation_5a_firmware:5a:*:*:*:*:*:*:*5aVulnerableOracle
cpe:2.3:h:oracle:micros_workstation_5a:-:*:*:*:*:*:*:*not specified by NVDRunning onOracle
cpe:2.3:o:oracle:micros_workstation_6_firmware:*:*:*:*:*:*:*:*610 – 655VulnerableOracle
cpe:2.3:h:oracle:micros_workstation_6:-:*:*:*:*:*:*:*not specified by NVDRunning onOracle
cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:*10.3.0.0.0 – 10.3.0.2.1; 10.4.0.1.0 – 10.4.0.3.1VulnerableOracle
cpe:2.3:a:oracle:tekelec_platform_distribution:*:*:*:*:*:*:*:*7.4.0 – 7.7.1VulnerableOracle
  • cpe:2.3:a:netapp:oncommand_unified_manager_core_package:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:* Versions 9 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:mcafee:web_gateway:8.2.17:*:*:*:*:*:*:* Versions 8.2.17 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:web_gateway:9.2.8:*:*:*:*:*:*:* Versions 9.2.8 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:web_gateway:10.0.4:*:*:*:*:*:*:* Versions 10.0.4 Vulnerable ·McAfee
  • cpe:2.3:a:synology:diskstation_manager_unified_controller:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Synology
  • cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:* Versions 6.2 Vulnerable ·Synology
  • cpe:2.3:o:synology:skynas_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Synology
  • cpe:2.3:h:synology:skynas:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Synology
  • cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Synology
  • cpe:2.3:h:synology:vs960hd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Synology
  • cpe:2.3:a:beyondtrust:privilege_management_for_mac:*:*:*:*:*:*:*:* Versions before 21.1.1 Vulnerable ·BeyondTrust
  • cpe:2.3:a:beyondtrust:privilege_management_for_unix\/linux:*:*:*:*:basic:*:*:* Versions before 10.3.2-10 Vulnerable ·BeyondTrust
  • cpe:2.3:o:oracle:micros_compact_workstation_3_firmware:310:*:*:*:*:*:*:* Versions 310 Vulnerable ·Oracle
  • cpe:2.3:h:oracle:micros_compact_workstation_3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Oracle
  • cpe:2.3:o:oracle:micros_es400_firmware:*:*:*:*:*:*:*:* Versions 400 – 410 Vulnerable ·Oracle
  • cpe:2.3:h:oracle:micros_es400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Oracle
  • cpe:2.3:o:oracle:micros_kitchen_display_system_firmware:210:*:*:*:*:*:*:* Versions 210 Vulnerable ·Oracle
  • cpe:2.3:h:oracle:micros_kitchen_display_system:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Oracle
  • cpe:2.3:o:oracle:micros_workstation_5a_firmware:5a:*:*:*:*:*:*:* Versions 5a Vulnerable ·Oracle
  • cpe:2.3:h:oracle:micros_workstation_5a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Oracle
  • cpe:2.3:o:oracle:micros_workstation_6_firmware:*:*:*:*:*:*:*:* Versions 610 – 655 Vulnerable ·Oracle
  • cpe:2.3:h:oracle:micros_workstation_6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Oracle
  • cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:* Versions 10.3.0.0.0 – 10.3.0.2.1; 10.4.0.1.0 – 10.4.0.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:tekelec_platform_distribution:*:*:*:*:*:*:*:* Versions 7.4.0 – 7.7.1 Vulnerable ·Oracle

Remediation

Red Hat 12 advisories

  • RHSA-2021:0401 Released 2021-02-03 · Red Hat rating Important
    Red Hat Virtualization Host security bug fix and enhancement update [ovirt-4.4.4]
    • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host-4.4.4-20210201.0.el8_3, redhat-virtualization-host-image-update-4.4.4-20210201.0.el8_3
  • RHSA-2021:0395 Released 2021-02-03 · Red Hat rating Important
    RHV-H security, bug fix, enhancement update (redhat-virtualization-host) 4.3.13
    • RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-virtualization-host-4.3.13-20210127.0.el7_9, redhat-virtualization-host-image-update-4.3.13-20210127.0.el7_9
    • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host-4.3.13-20210127.0.el7_9, redhat-virtualization-host-image-update-4.3.13-20210127.0.el7_9
  • RHSA-2021:0221 Released 2021-01-27 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux Client (v. 7) sudo-1.8.23-10.el7_9.1
    • Red Hat Enterprise Linux Client Optional (v. 7) sudo-devel-1.8.23-10.el7_9.1
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) sudo-devel-1.8.23-10.el7_9.1
    • Red Hat Enterprise Linux Server (v. 7) sudo-1.8.23-10.el7_9.1
    • Red Hat Enterprise Linux Server Optional (v. 7) sudo-devel-1.8.23-10.el7_9.1, sudo-devel-1.8.23-10.el7_9.1.ppc
    • Red Hat Enterprise Linux Workstation (v. 7) sudo-1.8.23-10.el7_9.1
    • Red Hat Enterprise Linux Workstation Optional (v. 7) sudo-devel-1.8.23-10.el7_9.1
Show 9 more Red Hat advisories
  • RHSA-2021:0223 Released 2021-01-27 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) sudo-1.8.23-3.el7_6.2
    • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) sudo-devel-1.8.23-3.el7_6.2
    • Red Hat Enterprise Linux Server EUS (v. 7.6) sudo-1.8.23-3.el7_6.2
    • Red Hat Enterprise Linux Server Optional EUS (v. 7.6) sudo-devel-1.8.23-3.el7_6.2, sudo-devel-1.8.23-3.el7_6.2.ppc
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) sudo-1.8.23-3.el7_6.2
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) sudo-devel-1.8.23-3.el7_6.2
  • RHSA-2021:0218 Released 2021-01-26 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux BaseOS (v. 8) sudo-1.8.29-6.el8_3.1
  • RHSA-2021:0222 Released 2021-01-26 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) sudo-1.8.23-4.el7_7.3
    • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) sudo-devel-1.8.23-4.el7_7.3
    • Red Hat Enterprise Linux Server EUS (v. 7.7) sudo-1.8.23-4.el7_7.3
    • Red Hat Enterprise Linux Server Optional EUS (v. 7.7) sudo-devel-1.8.23-4.el7_7.3, sudo-devel-1.8.23-4.el7_7.3.ppc
  • RHSA-2021:0224 Released 2021-01-26 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux Server AUS (v. 7.4) sudo-1.8.19p2-12.el7_4.2
    • Red Hat Enterprise Linux Server E4S (v. 7.4) sudo-1.8.19p2-12.el7_4.2
    • Red Hat Enterprise Linux Server Optional AUS (v. 7.4) sudo-devel-1.8.19p2-12.el7_4.2
    • Red Hat Enterprise Linux Server Optional E4S (v. 7.4) sudo-devel-1.8.19p2-12.el7_4.2
    • Red Hat Enterprise Linux Server Optional TUS (v. 7.4) sudo-devel-1.8.19p2-12.el7_4.2
    • Red Hat Enterprise Linux Server TUS (v. 7.4) sudo-1.8.19p2-12.el7_4.2
  • RHSA-2021:0227 Released 2021-01-26 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux Server (v. 6 ELS) sudo-1.8.6p3-29.el6_10.4
    • Red Hat Enterprise Linux Server Optional (v. 6 ELS) sudo-devel-1.8.6p3-29.el6_10.4
  • RHSA-2021:0219 Released 2021-01-26 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux BaseOS EUS (v. 8.2) sudo-1.8.29-5.el8_2.1
  • RHSA-2021:0225 Released 2021-01-26 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux Server AUS (v. 7.3) sudo-1.8.6p7-23.el7_3.3
    • Red Hat Enterprise Linux Server Optional AUS (v. 7.3) sudo-devel-1.8.6p7-23.el7_3.3
  • RHSA-2021:0220 Released 2021-01-26 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux BaseOS EUS (v. 8.1) sudo-1.8.25p1-8.el8_1.2
  • RHSA-2021:0226 Released 2021-01-26 · Red Hat rating Important
    sudo security update
    • Red Hat Enterprise Linux Server AUS (v. 7.2) sudo-1.8.6p7-17.el7_2.3
    • Red Hat Enterprise Linux Server Optional AUS (v. 7.2) sudo-devel-1.8.6p7-17.el7_2.3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHEL 7-based RHEV-H for RHEV 4 (build requirements)Fixed RHSA-2021:0395
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2021:0218
Red Hat Enterprise Linux BaseOS EUS (v. 8.1)Fixed RHSA-2021:0220
Red Hat Enterprise Linux BaseOS EUS (v. 8.2)Fixed RHSA-2021:0219
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2021:0221
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2021:0221
Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)Fixed RHSA-2021:0223
Red Hat Enterprise Linux ComputeNode EUS (v. 7.7)Fixed RHSA-2021:0222
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2021:0221
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)Fixed RHSA-2021:0223
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7)Fixed RHSA-2021:0222
Red Hat Enterprise Linux Server (v. 6 ELS)Fixed RHSA-2021:0227
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:0221
Red Hat Enterprise Linux Server AUS (v. 7.2)Fixed RHSA-2021:0226
Red Hat Enterprise Linux Server AUS (v. 7.3)Fixed RHSA-2021:0225
Red Hat Enterprise Linux Server AUS (v. 7.4)Fixed RHSA-2021:0224
Red Hat Enterprise Linux Server E4S (v. 7.4)Fixed RHSA-2021:0224
Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2021:0223
Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2021:0222
Red Hat Enterprise Linux Server Optional (v. 6 ELS)Fixed RHSA-2021:0227
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2021:0221
Red Hat Enterprise Linux Server Optional AUS (v. 7.2)Fixed RHSA-2021:0226
Red Hat Enterprise Linux Server Optional AUS (v. 7.3)Fixed RHSA-2021:0225
Red Hat Enterprise Linux Server Optional AUS (v. 7.4)Fixed RHSA-2021:0224
Red Hat Enterprise Linux Server Optional E4S (v. 7.4)Fixed RHSA-2021:0224
Red Hat Enterprise Linux Server Optional EUS (v. 7.6)Fixed RHSA-2021:0223
Red Hat Enterprise Linux Server Optional EUS (v. 7.7)Fixed RHSA-2021:0222
Red Hat Enterprise Linux Server Optional TUS (v. 7.4)Fixed RHSA-2021:0224
Red Hat Enterprise Linux Server TUS (v. 7.4)Fixed RHSA-2021:0224
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2021:0221
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2021:0221
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)Fixed RHSA-2021:0223
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)Fixed RHSA-2021:0223
Red Hat Virtualization 4 Hypervisor for RHEL 7Fixed RHSA-2021:0395
Red Hat Virtualization 4 Hypervisor for RHEL 8Fixed RHSA-2021:0401
Not affected: 6 products
  • RHEL 7-based RHEV-H for RHEV 4 (build requirements)
  • RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 9
  • Red Hat Virtualization 4 Hypervisor for RHEL 8
  • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts

Timeline

  1. 2022-04-06 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2021-3156
  3. 2026-10-03 Alias added: GHSA-w5vh-2923-gp5c

References

Exploit 12

Patch 4

Advisory 16

Other 2

  • TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
  • TI-2019-13863 In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the !… CVSS 3.1HIGH 7.5
  • TI-2019-13862 In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences