CVE-2021-3156

תיאור (מקור, אנגלית)

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

מדדים

CVSS 3.1

7.8 (HIGH) מקור הציון: NVD CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — סבירות ניצול

99% (אחוזון 100) נכון ל-4/8/2026

CWE

CWE-193

מוצרים מושפעים

sudo_project: sudo; fedoraproject: fedora; debian: debian linux; netapp: active iq unified manager; netapp: cloud backup; netapp: hci management node; netapp: oncommand unified manager core package; netapp: ontap select deploy administration utility; netapp: ontap tools; netapp: solidfire; mcafee: web gateway; synology: diskstation manager unified controller; synology: diskstation manager; synology: skynas firmware; synology: skynas

קישורים

• http://www.openwall.com/lists/oss-security/2021/09/14/2 Mailing ListPatchThird Party Advisory
• https://www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
• http://www.openwall.com/lists/oss-security/2021/09/14/2 Mailing ListPatchThird Party Advisory
• https://www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
• http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html ExploitThird Party AdvisoryVDB Entry
• http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Esc‮… ExploitThird Party AdvisoryVDB Entry