CVE-2021-3156
Sudo Heap-Based Buffer Overflow Vulnerability
Description
CVE-2021-3156, known as "Baron Samedit," is a heap-based buffer overflow vulnerability in Sudo that allows any local user to escalate privileges to root without requiring a valid password. The vulnerability has existed in Sudo for nearly 10 years, affecting versions 1.8.2 through 1.9.5p1, and is exploitable on default installations of major Linux distributions. It was added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. With an EPSS score of 96.8% (99.8th percentile), this is one of the most significant local privilege escalation vulnerabilities discovered in recent years.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| sudo project | sudo | >= 1.8.2, < 1.8.32; >= 1.9.0, < 1.9.5; 1.9.5 |
| fedoraproject | fedora | 32; 33 |
| debian | debian linux | 9.0; 10.0 |
| netapp | active iq unified manager | - |
| netapp | cloud backup | - |
| netapp | hci management node | - |
| netapp | oncommand unified manager core package | - |
| netapp | ontap select deploy administration utility | - |
| netapp | ontap tools | 9 |
| netapp | solidfire | - |
| mcafee | web gateway | 8.2.17; 9.2.8; 10.0.4 |
| synology | diskstation manager unified controller | 3.0 |
| synology | diskstation manager | 6.2 |
| synology | skynas firmware | - |
| synology | vs960hd firmware | - |
| beyondtrust | privilege management for mac | < 21.1.1 |
| beyondtrust | privilege management for unix\/linux | < 10.3.2-10 |
| oracle | micros compact workstation 3 firmware | 310 |
| oracle | micros es400 firmware | >= 400, <= 410 |
| oracle | micros kitchen display system firmware | 210 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html(Exploit, Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2021/Feb/42(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2021/Jan/79(Exploit, Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Feb/3(Exploit, Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/01/26/3(Exploit, Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/01/27/1(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/01/27/2(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/02/15/1(Exploit, Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/09/14/2(Mailing List, Patch, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2024/01/30/6(Exploit, Mailing List)
- http://www.openwall.com/lists/oss-security/2024/01/30/8(Mailing List)
- https://kc.mcafee.com/corporate/index?page=content&id=SB10348(Broken Link, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2021/01/msg00022.html(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CALA5FTXIQBRRYUA2ZQNJXB6OQMAXEII/(Mailing List, Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LHXK6ICO5AYLGFK2TAX5MZKUXTUKWOJY/(Mailing List, Release Notes)
- https://security.gentoo.org/glsa/202101-33(Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20210128-0001/(Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20210128-0002/(Third Party Advisory)
- https://support.apple.com/kb/HT212177(Third Party Advisory)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sudo-privesc-jan2021-qnYQfcM(Third Party Advisory)
- https://www.beyondtrust.com/blog/entry/security-advisory-privilege-management-for-unix-linux-pmul-basic-and-privilege-management-for-mac-pmm-affected-by-sudo-vulnerability(Third Party Advisory)
- https://www.debian.org/security/2021/dsa-4839(Third Party Advisory)
- https://www.kb.cert.org/vuls/id/794544(Third Party Advisory, US Government Resource)
- https://www.openwall.com/lists/oss-security/2021/01/26/3(Exploit, Mailing List, Third Party Advisory)
- https://www.oracle.com//security-alerts/cpujul2021.html(Patch, Third Party Advisory)
- https://www.oracle.com/security-alerts/cpuapr2022.html(Patch, Third Party Advisory)
- https://www.oracle.com/security-alerts/cpuoct2021.html(Patch, Third Party Advisory)
- https://www.sudo.ws/stable.html#1.9.5p2(Release Notes)
- https://www.synology.com/security/advisory/Synology_SA_21_02(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/sudoedit-pwned-cve-2021-3156(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3156(US Government Resource)
Weakness Type
CWE-122: Heap-based Buffer Overflow
A heap-based buffer overflow occurs when a program writes data beyond the bounds of allocated heap memory, potentially corrupting adjacent memory structures and enabling arbitrary code execution. In CVE-2021-3156, the overflow occurs during command-line argument parsing in Sudo's sudoedit mode, allowing controlled heap corruption that leads to root privilege escalation. For more details, see CWE-122.
Impact Analysis
This vulnerability allows any unprivileged local user to gain full root access on affected systems without requiring knowledge of the root password or being listed in the sudoers file. The impact is catastrophic for system security as it completely bypasses the privilege separation model that Sudo is designed to enforce. Organizations with multi-user Linux systems, shared hosting environments, or containerized workloads face significant risk, as any compromised low-privilege account can be escalated to full root access. The near-decade-long presence of this vulnerability means that a vast number of Linux systems in production environments were affected.
Exploit Maturity
CVE-2021-3156 (Baron Samedit) was added to CISA's KEV catalog on April 6, 2022, confirming active exploitation in the wild. The EPSS score of 96.8% (99.8th percentile) reflects the extremely high exploitation activity. Multiple reliable public exploits are available, and the vulnerability has been successfully demonstrated on Ubuntu, Debian, Fedora, and other major distributions. The straightforward exploitation path and universal presence of Sudo make this vulnerability highly attractive to attackers performing post-compromise privilege escalation.
Remediation
- Update Sudo to version 1.9.5p2 or later immediately, as required by CISA's KEV catalog. All major Linux distributions have released patched packages.
- Verify the patch is applied by running
sudo --versionand confirming the version is 1.9.5p2 or higher, or the distribution-specific patched version. - Audit systems for signs of exploitation, including unexpected root process activity, suspicious modifications to system files, and unusual entries in authentication logs.
- Implement additional monitoring for privilege escalation attempts using security tools such as auditd or Falco.
- As a defense-in-depth measure, restrict local login access to only authorized users who require interactive system access.
Technical Details
The vulnerability resides in Sudo's argument parsing logic when operating in sudoedit mode. When Sudo processes command-line arguments containing a trailing backslash character, a logic error in the set_cmnd() function causes a heap-based buffer overflow. Specifically, the code fails to properly escape backslashes when constructing the command string, writing beyond the allocated buffer boundary. An attacker can trigger this by invoking sudoedit with a carefully crafted argument ending in a single backslash. The resulting heap overflow can be leveraged to overwrite Sudo's internal data structures, ultimately achieving arbitrary code execution as root. The vulnerability does not require the attacker to have any sudo privileges.
Frequently Asked Questions
What is CVE-2021-3156 (Baron Samedit)?
CVE-2021-3156, nicknamed "Baron Samedit," is a heap-based buffer overflow in Sudo's sudoedit mode that allows any local user to escalate to root privileges without needing a valid password. It was discovered by the Qualys Research Team and had been present in Sudo for nearly 10 years.
How widespread is this vulnerability?
Extremely widespread. Sudo is installed by default on virtually every Linux and Unix-like system. The vulnerability affects Sudo versions 1.8.2 through 1.9.5p1, which covers nearly a decade of releases. All major Linux distributions were affected including Ubuntu, Debian, Red Hat, Fedora, and SUSE.
Does exploitation require sudo privileges?
No. This is particularly dangerous because it does not require the attacker to have any sudo privileges or to be listed in the sudoers file. Any local user with shell access can exploit this vulnerability to become root.
How can I test if my system is vulnerable?
Run sudoedit -s '\' $(python3 -c 'print("A"*1000)') from a non-root user. If the system is vulnerable, Sudo will crash with a segmentation fault. If patched, Sudo will display a usage error. Always test in a non-production environment first.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.