CVE-2021-3156
highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 1.000 · 100 %ileexploit · weaponizedDEEURUUSadded 2022-04-06remediate by 2022-04-27
required action Apply updates per vendor instructions.
EPSS · scored 2026-10-22
Sudo Heap-Based Buffer Overflow Vulnerability
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedtrumpf_psirt
- Update to TruControl version 3.16.0 or higher or - Please contact your service partner (service.tls@trumpf.com) for instructions on how to retrieve the patch
- FixedTyco AIcisa_csaf_ot
Johnson Controls recommends users update to Tyco AI v1.3, which includes the updates for the SUSE Linux operating system. Users are encouraged to contact Tyco technical support for assistance.
https://www.tyco.com/support-contacts - FixedVideoEdgecisa_csaf_ot
Johnson Controls recommends users upgrade to the latest VideoEdge release (currently 5.7.0). If this is not possible, a sudo patch is available from the American Dynamics website for VideoEdge 5.4.2 and 5.6.0. VideoEdge 5.4.1 and older cannot be patched and should be upgraded.
- FixedFlex Gen 2cisa_csaf_ot
Pro Gen 3: upgrade to Version 2.8.0
- FixedInsightcisa_csaf_ot
Pro Gen 3: upgrade to Version 2.8.0
- FixedPro 2cisa_csaf_ot
Pro Gen 3: upgrade to Version 2.8.0
- FixedPro Gen 3cisa_csaf_ot
Pro Gen 3: upgrade to Version 2.8.0
- FixedTXpert Hub CoreTec 4cisa_csaf_ot
TXpert Hub CoreTec 4: version 2.3.0
- MitigationexacqVisioncisa_csaf_ot
Johnson Controls recommends users install the latest security updates for the Ubuntu Linux operating system.
- MitigationVideoEdgecisa_csaf_ot
American Dynamics is a Johnson Controls brand. Users may contact American Dynamics technical support for assistance with updating their operating system. https://www.americandynamics.net/Support
https://www.americandynamics.net/Support - MitigationFlex Gen 2cisa_csaf_ot
Flex Gen 2: upgrade to Version 1.9.4
- MitigationInsightcisa_csaf_ot
Flex Gen 2: upgrade to Version 1.9.4
- MitigationPro 2cisa_csaf_ot
Flex Gen 2: upgrade to Version 1.9.4
- MitigationPro Gen 3cisa_csaf_ot
Flex Gen 2: upgrade to Version 1.9.4
- MitigationCEM Systems AC2000cisa_csaf_ot
Do not click web links or open unsolicited attachments in email messages.
- MitigationTXpert Hub CoreTec 4cisa_csaf_ot
Do not expose process control systems to the internet.
- No fix availablecisco_csaf
No remediation is available at this time.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (92)
Public proof-of-concept and weaponised exploit code.
- exploit/linux/local/sudo_baron_sameditSudo Heap-Based Buffer Overflowweaponized · metasploit
- 0x7183/CVE-2021-3156Sudo Heap Overflow Baron SameditPoC · poc_in_github
- 0xdevil/CVE-2021-3156CVE-2021-3156: Sudo heap overflow exploit for Debian 10PoC · poc_in_github
affected products (141)
Products and version ranges known to be affected.
- Avaya Aura Application Enablement Servicesall versionscert_bundDEcpe:/a:avaya:aura_application_enablement_services:-
- Juniper Contrail Service Orchestrationall versionscert_bundDEcpe:/a:juniper:contrail_service_orchestration:-
advisories (9)
Vendor and ecosystem advisories describing this.
- VDE-2021-011TRUMPF Laser GmbH: TruControl 2.14.0 to 3.14.0 affected by recent sudo vulnerability2021-03-22csaf · trumpf_psirtDE
TruControl laser control software from versions 2.14.0 to 3.14.0 use sudo versions affected by CVE-2021-3156. The affected sudo has a heap-based buffer overflow, allowing privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
- WID-SEC-W-2023-0066sudo: Schwachstelle ermöglicht PrivilegieneskalationDeutsch2021-01-26csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in sudo ausnutzen, um seine Privilegien zu erhöhen.
- cisco-sa-sudo-privesc-jan2021-qnYQfcMSudo Privilege Escalation Vulnerability Affecting Cisco Products: January 20212021-01-29csaf · cisco_csafUS
A vulnerability in the command line parameter parsing code of Sudo could allow an authenticated, local attacker to execute commands or binaries with root privileges. The vulnerability is due to improper parsing of command line parameters that may result in a heap-based buffer overflow. An attacker could exploit this vulnerability by accessing a Unix shell on an affected device and then invoking the sudoedit command with crafted parameters or by executing a binary exploit. A successful exploit could allow the attacker to execute commands or binaries with root privileges. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sudo-privesc-jan2021-qnYQfcM ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sudo-privesc-jan2021-qnYQfcM"]
- ICSA-21-119-03Johnson Controls Exacq Technologies exacqVision2021-04-29icsa · cisa_csaf_otUS
A local attacker could exploit this vulnerability to obtain Super User access to the underlying Ubuntu Linux operating system.
- ICSA-21-133-02Johnson Controls Sensormatic Tyco AI2021-05-13icsa · cisa_csaf_otUS
Under specific circumstances, a local attacker could use this vulnerability to obtain super-user access to the underlying openSUSE Linux operating system.
- ICSA-21-147-02Johnson Controls Sensormatic Electronics VideoEdge2021-05-27icsa · cisa_csaf_otUS
Under specific circumstances, a local authenticated user may be able to exploit this vulnerability to gain administrative access.
- ICSA-21-245-01Johnson Controls Sensormatic Electronics Illustra2021-09-02icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow a local attacker to obtain super user access to the underlying Linux operating system.
- ICSA-21-334-04Johnson Controls CEM Systems AC20002021-11-30icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow a local attacker to obtain super user access on the underlying Linux operating system.
- ICSA-22-256-01Hitachi Energy TXpert Hub CoreTec 4 Sudo Vulnerability2022-09-13icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to take control of the system node and its information.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (147)
External citations — patches, advisories, analysis.
- http://seclists.org/fulldisclosure/2021/Feb/42cnnvd
- http://seclists.org/fulldisclosure/2021/Jan/79cnnvd
- http://www.openwall.com/lists/oss-security/2021/01/26/3cnnvd
- http://www.openwall.com/lists/oss-security/2021/01/27/1cnnvd
- http://www.openwall.com/lists/oss-security/2021/01/27/2cnnvd
- http://www.openwall.com/lists/oss-security/2021/02/15/1cnnvd
- http://www.openwall.com/lists/oss-security/2021/09/14/2cnnvd
- https://access.redhat.com/security/cve/cve-2021-3156cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan