CVE-2021-3156

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

99.96% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2022-04-06

Nuclei

high · CWE-193

Published

2021-01-26

Updated

2025-10-21

Proof-of-concept exploits (111)

• http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html
• http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html
• http://packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escala…
• http://packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.html
• http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
• http://seclists.org/fulldisclosure/2024/Feb/3
• 0x7183/CVE-2021-31561★ · 2021-10-12
• 0xdevil/CVE-2021-315651★ · 2021-12-03
• 1N53C/CVE-2021-3156-PoC7★ · 2021-02-06
• Bad3r/CVE-2021-3156-without-ip-command0★ · 2024-11-13
• Bubleh21/CVE-2021-31560★ · 2021-10-20
• CptGibbon/CVE-2021-3156158★ · 2022-02-13
• DASICS-ICT/DASICS-CVE-2021-31561★ · 2025-06-20
• DDayLuong/CVE-2021-31560★ · 2023-12-27
• Exodusro/CVE-2021-31560★ · 2021-07-25
• HuzaifaTariqAfzalKhan/CVE-Exploit-Research-Development-ITSOLERA0★ · 2025-08-25
• JeanR12/Persistence-Script-Script-Exploit-0★ · 2024-08-13
• Maalfer/Sudo-CVE-2021-31568★ · 2025-07-19
• Mhackiori/CVE-2021-31565★ · 2022-07-15
• Nerix-code/hello0★ · 2025-05-13
• NormalPerson001/sudo-1.8.311★ · 2024-06-20
• PhuketIsland/CVE-2021-3156-centos730★ · 2022-11-03
• PurpleOzone/PE_CVE-CVE-2021-31567★ · 2023-05-13
• Q4n/CVE-2021-31562★ · 2021-01-31
• RodricBr/CVE-2021-31561★ · 2022-08-19
• Rvn0xsy/CVE-2021-3156-plus203★ · 2021-02-09
• SantiagoSerrao/ScannerCVE-2021-31561★ · 2021-02-01
• Sebastianbedoya25/CVE-2021-31560★ · 2024-12-03
• Shuhaib88/Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-31561★ · 2025-05-24
• Sornphut/CVE-2021-3156-Heap-Based-Buffer-Overflow-in-Sudo-Baron-Samedit-0★ · 2025-03-11
• TheFlash2k/CVE-2021-31561★ · 2021-06-30
• TopskiyPavelQwertyGang/Review.CVE-2021-31560★ · 2025-06-09
• Whiteh4tWolf/Sudo-1.8.31-Root-Exploit4★ · 2024-04-10
• WilliamQ28/Worst-autoLinPrivesc0★ · 2025-07-30
• ZacharyKirkeby/CVE_a_Week0★ · 2025-05-27
• anukiii/Malware_Project_team30★ · 2024-01-11
• apogiatzis/docker-CVE-2021-31567★ · 2021-01-31
• arvindshima/CVE-2021-31560★ · 2022-06-24
• asepsaepdin/CVE-2021-31560★ · 2023-09-05
• baka9moe/CVE-2021-3156-Exp4★ · 2021-01-28
• barebackbandit/CVE-2021-31560★ · 2022-01-30
• binw2018/CVE-2021-3156-SCRIPT1★ · 2021-01-29
• blackberry/Falco-bypasses90★ · 2024-01-28
• blasty/CVE-2021-31561024★ · 2021-02-02
• capturingcats/CVE-2021-31560★ · 2021-04-05
• chenaotian/CVE-2021-315611★ · 2022-05-23
• d3c3ptic0n/CVE-2021-31560★ · 2021-08-16
• dinhbaouit/CVE-2021-31565★ · 2021-02-03
• donghyunlee00/CVE-2021-31561★ · 2021-06-25
• duedahl/sudoedit_exploit0★ · 2024-11-13
• elbee-cyber/CVE-2021-3156-PATCHER3★ · 2021-01-28
• freeFV/CVE-2021-31560★ · 2021-01-29
• gmldbd94/cve-2021-31560★ · 2021-02-09
• greg-workspace/my_sudo_heap_overflow_exploit0★ · 2021-03-31
• grng3r/rs_exploits0★ · 2022-03-14
• halissha/CVE-2021-31560★ · 2021-10-20
• hycheng15/CVE-2021-31560★ · 2023-11-14
• jm33-m0/CVE-2021-315616★ · 2021-02-09
• joaomagfreitas/tpas-binary-exploitation2★ · 2022-02-16
• joshmcorreia/SDSU_Cyber_Security_Red_Team0★ · 2025-12-04
• kal1gh0st/CVE-2021-31563★ · 2021-05-04
• kasperyhr/CSCI620_FinalProject0★ · 2023-11-26
• kernelzeroday/CVE-2021-3156-Baron-Samedit18★ · 2021-01-29
• kldksd/server0★ · 2022-09-02
• lmol/CVE-2021-31564★ · 2021-03-25
• lockedbyte/CVE-Exploits690★ · 2021-08-21
• lockedbyte/slides8★ · 2022-05-27
• mbcrump/CVE-2021-315639★ · 2021-01-31
• meowhua15/CVE-2021-31560★ · 2023-11-14
• mr-r3b00t/CVE-2021-315635★ · 2021-01-26
• mrkronkz/exp0★ · 2023-11-09
• musergi/CVE-2021-31562★ · 2021-12-01
• mutur4/CVE-2021-31560★ · 2024-04-10
• nexcess/sudo_cve-2021-31560★ · 2021-01-27
• njahrckstr/exploits-1★ · 2021-02-02
• nobodyatall648/CVE-2021-31561★ · 2021-02-01
• oneoy/CVE-2021-31560★ · 2021-02-23
• oriolOrnaque/TFG-Binary-exploitation0★ · 2021-07-23
• ph4ntonn/CVE-2021-31563★ · 2021-01-28
• pmihsan/Sudo-HeapBased-Buffer-Overflow2★ · 2023-01-16
• puckiestyle/CVE-2021-31561★ · 2022-03-04
• q77190858/CVE-2021-31561★ · 2022-05-26
• r4j0x00/exploits2522★ · 2023-01-02
• redhawkeye/sudo-exploit17★ · 2021-09-25
• reverse-ex/CVE-2021-3156112★ · 2021-01-31
• rfago/tpas-binary-exploitation0★ · 2022-03-09
• saucer-man/exploit11★ · 2021-07-09
• scaryPonens/cve_bot0★ · 2024-05-03
• sharkmoos/Baron-Samedit0★ · 2022-01-23
• shishirpandey18/CVE-2021-31560★ · 2025-05-12
• stong/CVE-2021-3156429★ · 2022-04-14
• teamtopkarl/CVE-2021-31567★ · 2021-01-31
• ten-ops/baron-samedit0★ · 2025-02-11
• unauth401/CVE-2021-31561★ · 2021-01-27
• weto91/GitHub_Search_CVE0★ · 2026-04-27
• worawit/CVE-2021-3156809★ · 2022-01-13
• wurwur/CVE-2021-31560★ · 2024-01-22
• yaunsky/cve-2021-31565★ · 2021-01-28
• ymrsmns/CVE-2021-31560★ · 2021-01-31
• Rana-Ali93/CVE-2021-3156-Sudo-Buffer-Overflow-Linux0★ · 2026-03-18
• Shams-Ul-Mehmood/CVE-2021-3156-Project0★ · 2026-08-19
• TheLeopard65/CVE-2021-3156-Baron-Samedit1★ · 2026-03-11
• WhatsWrongAndWhy/CVE-2021-31560★ · 2026-07-21
• czeti/baron-samedit0★ · 2025-02-11
• ngtuonghung/CVE-2021-31560★ · 2026-03-25
• sbladiamond/CVE-2021-31560★ · 2021-08-07
• juju306/CVE-2021-31561★ · 2022-05-26
• wangqian306/CVE-2021-31561★ · 2022-05-26
• wangqian06/CVE-2021-31561★ · 2022-05-26
• Kranti08/CVE-2021-3156-Baron-Samedit/blob/996fdce11a52356e8b1e16dcca79d8b78dfb75e5/CVE-20…0★ · 2026-06-17
• ConstantineFedorov/Review.CVE-2021-3156/blob/9fb543f64f0c55a3b0e07594938f22525ed79ae9/exp…0★ · 2025-06-09

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/code/cves/2021/CVE-2021-3156.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/sudo_baron_samedit.rb

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/49522
• https://www.exploit-db.com/exploits/49521

Exploit collections (3)

• CVE-2021-3156helloexp/0day
• CVE-2021-3156_one_shothelloexp/0day
• CVE-2021-3156 (Baron Samedit) Sudo 中基于堆的缓冲区溢出漏洞.mdtzwlhack/Vulnerability

Security advisories

• http://seclists.org/fulldisclosure/2021/Feb/42
• http://seclists.org/fulldisclosure/2021/Jan/79
• http://www.openwall.com/lists/oss-security/2021/01/26/3
• http://www.openwall.com/lists/oss-security/2021/01/27/1
• http://www.openwall.com/lists/oss-security/2021/01/27/2
• http://www.openwall.com/lists/oss-security/2021/02/15/1
• http://www.openwall.com/lists/oss-security/2021/09/14/2
• https://kc.mcafee.com/corporate/index?page=content&id=SB10348
• https://lists.debian.org/debian-lts-announce/2021/01/msg00022.html
• https://security.gentoo.org/glsa/202101-33
• https://security.netapp.com/advisory/ntap-20210128-0001
• https://security.netapp.com/advisory/ntap-20210128-0002
• https://support.apple.com/kb/HT212177
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sudo-prive…
• https://www.beyondtrust.com/blog/entry/security-advisory-privilege-management-for-unix-li…
• https://www.debian.org/security/2021/dsa-4839
• https://www.kb.cert.org/vuls/id/794544
• https://www.openwall.com/lists/oss-security/2021/01/26/3
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://www.synology.com/security/advisory/Synology_SA_21_02
• https://www.vicarius.io/vsociety/posts/sudoedit-pwned-cve-2021-3156
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/…
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/…
• https://www.sudo.ws/stable.html#1.9.5p2

References

• CVE Record
• NVD entry

Related

• CVE-2021-42008
• CVE-2025-38001
• CVE-2019-18634
• CVE-2011-2523
• CVE-2020-25213
• CVE-2023-38831