Heap-Based Buffer Overflow in Sudo Package: CVE-2021-3156
Summary
ALPINE-CVE-2021-3156: Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash... Affects sudo versions < 1.9.5p2-r0. Fixed in 1.9.5p2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sudo is a widely used program that allows users to run commands with the security privileges of another user, typically the superuser. It is an essential tool in Unix-like operating systems, providing a mechanism for granting limited administrative access to users. The vulnerability in question affects various versions of the Sudo package across multiple Alpine Linux releases, making it critical for system administrators to address.
Vulnerability Detail
The vulnerability, identified as CVE-2021-3156, is an off-by-one error in Sudo versions prior to 1.9.5p2. This flaw can lead to a heap-based buffer overflow, which may allow an attacker to escalate privileges to root. The issue arises when using the 'sudoedit -s' command with a command-line argument that ends with a single backslash character. This can potentially compromise the security of the system, allowing unauthorized access and control.
How To Fix
Minimum fixed version
1.9.5p2-r0
This is the first release that contains the fix.
sudo apk add --upgrade sudoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the 'sudoedit -s' command with arguments that end with a backslash until the package is updated. This can help mitigate the risk of exploitation while waiting for a patch.
Conclusion
CVE-2021-3156 is a critical vulnerability in the Sudo package that can lead to serious security risks if not addressed. It is crucial for users to update their Sudo installations to the patched versions to protect their systems from potential exploitation.
See every vulnerability recorded for sudo →
FAQ
CVE-2021-3156 is a vulnerability in the Sudo package that can lead to a heap-based buffer overflow, allowing privilege escalation to root.
Sudo versions prior to 1.9.5p2 and 1.8.31-r1 for Alpine Linux are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The CVSS score for CVE-2021-3156 is 7.8, indicating a high severity level.
If an immediate update is not possible, avoid using the 'sudoedit -s' command with backslash arguments as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for sudo.
