CVE-2021-3156

Name of the Vulnerable Software and Affected Versions Sudo versions 1.8.2 through 1.8.31p2 Sudo versions 1.9.0 through 1.9.5p1

Description A heap-based buffer overflow exists in the parse args() function. This issue is caused by an off-by-one error that occurs when using sudoedit -s with a command-line argument ending in a single backslash character. A local unprivileged user, including the nobody account, can exploit this flaw to bypass authentication and escalate privileges to root.

Recommendations Update Sudo to version 1.9.5p2 or later. As a temporary mitigation, restrict the use of the sudoedit -s command for unprivileged users.