cyfenced.com →

[ CVE-2021-3156 · Published 26 Jan 2021 ]

Sudo Heap-Based Buffer Overflow Vulnerability

Exploited · CISA KEV CVSS 7.8 EPSS 100%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-04-06
  • EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

CISA: Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 27 Apr 2022): Apply updates per vendor instructions.

[ References ]References