CVE-2021-3156 Baron Samedit: Sudo Heap-Based Buffer Overflow
A heap-based buffer overflow in Sudo allows local attackers to escalate privileges to root via a crafted command-line argument.
- Exploited in the wild
- Since 6 Apr 2022
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3156?
CVE-2021-3156 (Baron Samedit) is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 26 Jan 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
Weakness: CWE-193
Which versions are affected by CVE-2021-3156?
It affects 24 products.
Linux distribution packages (40)
sudo Red Hat:enterprise_linux:7::client | All versions | 0:1.8.23-10.el7_9.1 |
sudo-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:1.8.23-10.el7_9.1 |
sudo-devel Red Hat:enterprise_linux:7::client | All versions | 0:1.8.23-10.el7_9.1 |
sudo-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.23-10.el7_9.1 |
sudo-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:1.8.23-10.el7_9.1 |
sudo Red Hat:enterprise_linux:7::server | All versions | 0:1.8.23-10.el7_9.1 |
sudo-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:1.8.23-10.el7_9.1 |
sudo-devel Red Hat:enterprise_linux:7::server | All versions | 0:1.8.23-10.el7_9.1 |
sudo Red Hat:enterprise_linux:7::workstation | All versions | 0:1.8.23-10.el7_9.1 |
sudo-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:1.8.23-10.el7_9.1 |
sudo-devel Red Hat:enterprise_linux:7::workstation | All versions | 0:1.8.23-10.el7_9.1 |
sudo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.8.29-6.el8_3.1 |
sudo-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.8.29-6.el8_3.1 |
sudo-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:1.8.29-6.el8_3.1 |
sudo Red Hat:rhel_aus:7.2::server | All versions | 0:1.8.6p7-17.el7_2.3 |
sudo-debuginfo Red Hat:rhel_aus:7.2::server | All versions | 0:1.8.6p7-17.el7_2.3 |
sudo-devel Red Hat:rhel_aus:7.2::server | All versions | 0:1.8.6p7-17.el7_2.3 |
sudo Red Hat:rhel_aus:7.3::server | All versions | 0:1.8.6p7-23.el7_3.3 |
sudo-debuginfo Red Hat:rhel_aus:7.3::server | All versions | 0:1.8.6p7-23.el7_3.3 |
sudo-devel Red Hat:rhel_aus:7.3::server | All versions | 0:1.8.6p7-23.el7_3.3 |
sudo Red Hat:rhel_aus:7.4::server | All versions | 0:1.8.19p2-12.el7_4.2 |
sudo-debuginfo Red Hat:rhel_aus:7.4::server | All versions | 0:1.8.19p2-12.el7_4.2 |
sudo-devel Red Hat:rhel_aus:7.4::server | All versions | 0:1.8.19p2-12.el7_4.2 |
sudo Red Hat:rhel_e4s:7.4::server | All versions | 0:1.8.19p2-12.el7_4.2 |
sudo-debuginfo Red Hat:rhel_e4s:7.4::server | All versions | 0:1.8.19p2-12.el7_4.2 |
sudo-devel Red Hat:rhel_e4s:7.4::server | All versions | 0:1.8.19p2-12.el7_4.2 |
sudo Red Hat:rhel_els:6 | All versions | 0:1.8.6p3-29.el6_10.4 |
sudo-debuginfo Red Hat:rhel_els:6 | All versions | 0:1.8.6p3-29.el6_10.4 |
sudo-devel Red Hat:rhel_els:6 | All versions | 0:1.8.6p3-29.el6_10.4 |
sudo Red Hat:rhel_eus:7.6::computenode | All versions | 0:1.8.23-3.el7_6.2 |
sudo-debuginfo Red Hat:rhel_eus:7.6::computenode | All versions | 0:1.8.23-3.el7_6.2 |
sudo-devel Red Hat:rhel_eus:7.6::computenode | All versions | 0:1.8.23-3.el7_6.2 |
sudo Red Hat:rhel_eus:7.6::server | All versions | 0:1.8.23-3.el7_6.2 |
sudo-debuginfo Red Hat:rhel_eus:7.6::server | All versions | 0:1.8.23-3.el7_6.2 |
sudo-devel Red Hat:rhel_eus:7.6::server | All versions | 0:1.8.23-3.el7_6.2 |
sudo Red Hat:rhel_eus:7.7::computenode | All versions | 0:1.8.23-4.el7_7.3 |
sudo-debuginfo Red Hat:rhel_eus:7.7::computenode | All versions | 0:1.8.23-4.el7_7.3 |
sudo-devel Red Hat:rhel_eus:7.7::computenode | All versions | 0:1.8.23-4.el7_7.3 |
sudo Red Hat:rhel_eus:7.7::server | All versions | 0:1.8.23-4.el7_7.3 |
sudo-debuginfo Red Hat:rhel_eus:7.7::server | All versions | 0:1.8.23-4.el7_7.3 |
Products include Beyondtrust Privilege Management for Mac, Beyondtrust Privilege Management for Unix\/Linux, Debian Debian Linux, Fedoraproject Fedora, Mcafee Web Gateway, Netapp Active Iq Unified Manager and 18 more.
How do I fix CVE-2021-3156?
Apply the vendor's patch. US federal agencies must fix it by 27 Apr 2022.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-3156 being exploited?
Yes. Attackers have exploited CVE-2021-3156 in the wild since at least 6 Apr 2022.
Public exploit code: 1 Metasploit module, 2 Exploit-DB entries and 88 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-3156, CLSA-2021-1611743864, CLSA-2021-1634925665, DEBIAN-CVE-2021-3156, DLA-2534-1, DSA-4839-1 and 21 more.