CVE catalog

CVE-2021-3156

sudo: CVE-2021-3156

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
Exploitation
CISA Known Exploited Vulnerabilities
EPSS
99.96% · Oct 25, 2026

Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansudosid1.9.17p2-9fixed
Debiansudoforky1.9.17p2-9fixed
Debiansudotrixie1.9.16p2-3+deb13u2fixed
Debiansudobookworm1.9.13p3-1+deb12u4fixed
Debiansudobookworm-security1.9.13p3-1+deb12u2fixed
Alpinesudo3.101.9.5p2-r0fixed
Alpinesudo3.111.8.31-r1fixed
Alpinesudo3.121.9.5p2-r0fixed
Alpinesudo3.131.9.5p2-r0fixed
Alpinesudo3.141.9.5p2-r0fixed
Alpinesudo3.151.9.5p2-r0fixed
Ubuntusudopro1.8.6p3-0ubuntu3vulnerable
Ubuntusudopro1.8.8-2ubuntu1vulnerable
Ubuntusudopro1.8.8-2ubuntu2vulnerable
Ubuntusudopro1.8.9p4-1ubuntu1vulnerable
Ubuntusudopro1.8.9p4-1ubuntu2vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1.1vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1.2vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1.3vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1.4vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1.5+esm1vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1.5+esm2vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1.5+esm3vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1.5+esm5vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1.5+esm6fixed
Susesudoopenstack cloud 71.8.10p3-10.32.1fixed
Susesudolinux enterprise server for sap applications 12 sp21.8.10p3-10.32.1fixed
Susesudolinux enterprise server 12 sp2-ltss1.8.10p3-10.32.1fixed
Susesudolinux enterprise server 12 sp2-bcl1.8.10p3-10.32.1fixed
Susesudolinux enterprise module for basesystem 15 sp21.8.22-4.18.1fixed
Susesudolinux enterprise high performance computing 15-espos1.8.22-4.18.1fixed
Susesudolinux enterprise high performance computing 15-ltss1.8.22-4.18.1fixed
Susesudolinux enterprise high performance computing 15 sp1-espos1.8.22-4.18.1fixed
Susesudolinux enterprise high performance computing 15 sp1-ltss1.8.22-4.18.1fixed
Susesudolinux enterprise server 15-ltss1.8.22-4.18.1fixed
Susesudolinux enterprise server 15 sp1-bcl1.8.22-4.18.1fixed
Susesudolinux enterprise server 15 sp1-ltss1.8.22-4.18.1fixed
Susesudolinux enterprise server for sap applications 151.8.22-4.18.1fixed
Susesudolinux enterprise server for sap applications 15 sp11.8.22-4.18.1fixed
Susesudomanager proxy 4.01.8.22-4.18.1fixed
Susesudomanager retail branch server 4.01.8.22-4.18.1fixed
Susesudomanager server 4.01.8.22-4.18.1fixed
Susesudolinux enterprise micro 5.01.8.22-4.18.1fixed
Susesudoenterprise storage 61.8.22-4.18.1fixed
Susesudolinux enterprise software development kit 12 sp51.8.27-4.15.1fixed
Susesudolinux enterprise server 12 sp51.8.27-4.15.1fixed
Susesudolinux enterprise server for sap applications 12 sp51.8.27-4.15.1fixed
Ubuntusudopro1.8.6p3-0ubuntu3vulnerable
Ubuntusudopro1.8.8-2ubuntu1vulnerable
Ubuntusudopro1.8.8-2ubuntu2vulnerable
Ubuntusudopro1.8.9p4-1ubuntu1vulnerable
Ubuntusudopro1.8.9p4-1ubuntu2vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1.1vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1.2vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1.3vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1.4vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1.5+esm1vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1.5+esm2vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1.5+esm3vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1.5+esm5vulnerable
Ubuntusudopro1.8.9p5-1ubuntu1.5+esm6fixed
Ubuntusudo16.041.8.12-1ubuntu3vulnerable
Ubuntusudo16.041.8.16-0ubuntu1vulnerable
Ubuntusudo16.041.8.16-0ubuntu1.1vulnerable
Ubuntusudo16.041.8.16-0ubuntu1.2vulnerable
Ubuntusudo16.041.8.16-0ubuntu1.3vulnerable
Ubuntusudo16.041.8.16-0ubuntu1.4vulnerable
Ubuntusudo16.041.8.16-0ubuntu1.5vulnerable
Ubuntusudo16.041.8.16-0ubuntu1.6vulnerable
Ubuntusudo16.041.8.16-0ubuntu1.7vulnerable
Ubuntusudo16.041.8.16-0ubuntu1.8vulnerable
Ubuntusudo16.041.8.16-0ubuntu1.9vulnerable
Ubuntusudo16.041.8.16-0ubuntu1.10fixed
Ubuntusudo18.041.8.20p2-1ubuntu1vulnerable
Ubuntusudo18.041.8.21p2-2ubuntu1vulnerable
Ubuntusudo18.041.8.21p2-3ubuntu1vulnerable
Ubuntusudo18.041.8.21p2-3ubuntu1.1vulnerable
Ubuntusudo18.041.8.21p2-3ubuntu1.2vulnerable
Ubuntusudo18.041.8.21p2-3ubuntu1.3vulnerable
Ubuntusudo18.041.8.21p2-3ubuntu1.4fixed
Ubuntusudo20.041.8.27-1ubuntu4vulnerable
Ubuntusudo20.041.8.29-1ubuntu1vulnerable
Ubuntusudo20.041.8.31-1ubuntu1vulnerable
Ubuntusudo20.041.8.31-1ubuntu1.1vulnerable
Ubuntusudo20.041.8.31-1ubuntu1.2fixed
Opensusesudoleap 15.21.8.22-lp152.8.9.1fixed
Susesudolinux enterprise server 12 sp2-bcl1.8.10p3-10.35.1fixed
Susesudohpe helion openstack 81.8.20p2-3.23.1fixed
Susesudoopenstack cloud 81.8.20p2-3.23.1fixed
Susesudoopenstack cloud 91.8.20p2-3.23.1fixed
Susesudoopenstack cloud crowbar 81.8.20p2-3.23.1fixed
Susesudoopenstack cloud crowbar 91.8.20p2-3.23.1fixed
Susesudolinux enterprise server for sap applications 12 sp31.8.20p2-3.23.1fixed
Susesudolinux enterprise server for sap applications 12 sp41.8.20p2-3.23.1fixed
Susesudolinux enterprise server 12 sp3-ltss1.8.20p2-3.23.1fixed
Susesudolinux enterprise server 12 sp3-bcl1.8.20p2-3.23.1fixed
Susesudolinux enterprise server 12 sp4-ltss1.8.20p2-3.23.1fixed
Susesudolinux enterprise server 12 sp5-ltss1.8.27-4.51.1fixed
Susesudolinux enterprise server ltss extended security 12 sp51.8.27-4.51.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansudosourcesid1.9.5p1-1.1not yet assignedNot reportedNot reported
Debiansudosourceforky1.9.5p1-1.1not yet assignedNot reportedNot reported
Debiansudosourcetrixie1.9.5p1-1.1not yet assignedNot reportedNot reported
Debiansudosourcebookworm1.9.5p1-1.1not yet assignedNot reportedNot reported
Alpinesudoapk3.101.9.5p2-r0Not reportedALPINE-CVE-2021-3156Not reported
Alpinesudoapk3.111.8.31-r1Not reportedALPINE-CVE-2021-3156Not reported
Alpinesudoapk3.121.9.5p2-r0Not reportedALPINE-CVE-2021-3156Not reported
Alpinesudoapk3.131.9.5p2-r0Not reportedALPINE-CVE-2021-3156Not reported
Alpinesudoapk3.141.9.5p2-r0Not reportedALPINE-CVE-2021-3156Not reported
Alpinesudoapk3.151.9.5p2-r0Not reportedALPINE-CVE-2021-3156Not reported
Ubuntusudodebpro1.8.9p5-1ubuntu1.5+esm6Not reportedUSN-4705-2Not reported
Susesudorpmopenstack cloud 71.8.10p3-10.32.1Not reportedSUSE-SU-2021:0928-1Not reported
Susesudorpmlinux enterprise server for sap applications 12 sp21.8.10p3-10.32.1Not reportedSUSE-SU-2021:0928-1Not reported
Susesudorpmlinux enterprise server 12 sp2-ltss1.8.10p3-10.32.1Not reportedSUSE-SU-2021:0928-1Not reported
Susesudorpmlinux enterprise server 12 sp2-bcl1.8.10p3-10.32.1Not reportedSUSE-SU-2021:0928-1Not reported
Susesudorpmlinux enterprise module for basesystem 15 sp21.8.22-4.18.1Not reportedSUSE-SU-2021:1275-1Not reported
Susesudorpmlinux enterprise high performance computing 15-espos1.8.22-4.18.1Not reportedSUSE-SU-2021:1275-1Not reported
Susesudorpmlinux enterprise high performance computing 15-ltss1.8.22-4.18.1Not reportedSUSE-SU-2021:1275-1Not reported
Susesudorpmlinux enterprise high performance computing 15 sp1-espos1.8.22-4.18.1Not reportedSUSE-SU-2021:1275-1Not reported
Susesudorpmlinux enterprise high performance computing 15 sp1-ltss1.8.22-4.18.1Not reportedSUSE-SU-2021:1275-1Not reported
Susesudorpmlinux enterprise server 15-ltss1.8.22-4.18.1Not reportedSUSE-SU-2021:1275-1Not reported
Susesudorpmlinux enterprise server 15 sp1-bcl1.8.22-4.18.1Not reportedSUSE-SU-2021:1275-1Not reported
Susesudorpmlinux enterprise server 15 sp1-ltss1.8.22-4.18.1Not reportedSUSE-SU-2021:1275-1Not reported
Susesudorpmlinux enterprise server for sap applications 151.8.22-4.18.1Not reportedSUSE-SU-2021:1275-1Not reported
Susesudorpmlinux enterprise server for sap applications 15 sp11.8.22-4.18.1Not reportedSUSE-SU-2021:1275-1Not reported
Susesudorpmmanager proxy 4.01.8.22-4.18.1Not reportedSUSE-SU-2021:1275-1Not reported
Susesudorpmmanager retail branch server 4.01.8.22-4.18.1Not reportedSUSE-SU-2021:1275-1Not reported
Susesudorpmmanager server 4.01.8.22-4.18.1Not reportedSUSE-SU-2021:1275-1Not reported
Susesudorpmlinux enterprise micro 5.01.8.22-4.18.1Not reportedSUSE-SU-2021:1275-1Not reported
Susesudorpmenterprise storage 61.8.22-4.18.1Not reportedSUSE-SU-2021:1275-1Not reported
Susesudorpmlinux enterprise software development kit 12 sp51.8.27-4.15.1Not reportedSUSE-SU-2021:1274-1Not reported
Susesudorpmlinux enterprise server 12 sp51.8.27-4.15.1Not reportedSUSE-SU-2021:1274-1Not reported
Susesudorpmlinux enterprise server for sap applications 12 sp51.8.27-4.15.1Not reportedSUSE-SU-2021:1274-1Not reported
Ubuntusudodebpro1.8.9p5-1ubuntu1.5+esm6Not reportedUBUNTU-CVE-2021-3156Not reported
Ubuntusudodeb16.041.8.16-0ubuntu1.10Not reportedUBUNTU-CVE-2021-3156Not reported
Ubuntusudodeb18.041.8.21p2-3ubuntu1.4Not reportedUBUNTU-CVE-2021-3156Not reported
Ubuntusudodeb20.041.8.31-1ubuntu1.2Not reportedUBUNTU-CVE-2021-3156Not reported
Opensusesudorpmleap 15.21.8.22-lp152.8.9.1Not reportedOPENSUSE-SU-2021:0602-1Not reported
Susesudorpmlinux enterprise server 12 sp2-bcl1.8.10p3-10.35.1Not reportedSUSE-SU-2021:1267-1Not reported
Susesudorpmhpe helion openstack 81.8.20p2-3.23.1Not reportedSUSE-SU-2021:1273-1Not reported
Susesudorpmopenstack cloud 81.8.20p2-3.23.1Not reportedSUSE-SU-2021:1273-1Not reported
Susesudorpmopenstack cloud 91.8.20p2-3.23.1Not reportedSUSE-SU-2021:1273-1Not reported
Susesudorpmopenstack cloud crowbar 81.8.20p2-3.23.1Not reportedSUSE-SU-2021:1273-1Not reported
Susesudorpmopenstack cloud crowbar 91.8.20p2-3.23.1Not reportedSUSE-SU-2021:1273-1Not reported
Susesudorpmlinux enterprise server for sap applications 12 sp31.8.20p2-3.23.1Not reportedSUSE-SU-2021:1273-1Not reported
Susesudorpmlinux enterprise server for sap applications 12 sp41.8.20p2-3.23.1Not reportedSUSE-SU-2021:1273-1Not reported
Susesudorpmlinux enterprise server 12 sp3-ltss1.8.20p2-3.23.1Not reportedSUSE-SU-2021:1273-1Not reported
Susesudorpmlinux enterprise server 12 sp3-bcl1.8.20p2-3.23.1Not reportedSUSE-SU-2021:1273-1Not reported
Susesudorpmlinux enterprise server 12 sp4-ltss1.8.20p2-3.23.1Not reportedSUSE-SU-2021:1273-1Not reported
Susesudorpmlinux enterprise server 12 sp5-ltss1.8.27-4.51.1Not reportedSUSE-SU-2024:4389-1Not reported
Susesudorpmlinux enterprise server ltss extended security 12 sp51.8.27-4.51.1Not reportedSUSE-SU-2024:4389-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • Source package: [sudo]

    Details (4)
    • 1.9.13p3-1+deb12u4 · all · bookworm

      Fixed · Fixed: 1.9.5p1-1.1

      dsa · sudo · debian · bookworm; dsa · sudo · debian · 12

    • 1.9.13p3-1+deb12u4 · all · bookworm

      Fixed · Fixed: 1.9.5p1-1.1

      dsa · sudo · debian · bookworm; dsa · sudo · debian · 12

    • 1.9.13p3-1+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.9.5p1-1.1

      dsa · sudo · debian · bookworm; dsa · sudo · debian · 12

    • 1.9.13p3-1+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.9.5p1-1.1

      dsa · sudo · debian · bookworm; dsa · sudo · debian · 12

  • [sudo]Fixed
    Details (4)
    • 1.9.13p3-1+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 1.9.5p1-1.1

      dsa · sudo · debian · bookworm; dsa · sudo · debian · 12

    • 1.9.13p3-1+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 1.9.5p1-1.1

      dsa · sudo · debian · bookworm; dsa · sudo · debian · 12

    • 1.9.13p3-1+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1.9.5p1-1.1

      dsa · sudo · debian · bookworm; dsa · sudo · debian · 12

    • 1.9.13p3-1+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1.9.5p1-1.1

      dsa · sudo · debian · bookworm; dsa · sudo · debian · 12

  • [sudo-ldap]Fixed

    Source package: [sudo]

    Details (4)
    • 1.9.13p3-1+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 1.9.5p1-1.1

      dsa · sudo · debian · bookworm; dsa · sudo · debian · 12

    • 1.9.13p3-1+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 1.9.5p1-1.1

      dsa · sudo · debian · bookworm; dsa · sudo · debian · 12

    • 1.9.13p3-1+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1.9.5p1-1.1

      dsa · sudo · debian · bookworm; dsa · sudo · debian · 12

    • 1.9.13p3-1+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1.9.5p1-1.1

      dsa · sudo · debian · bookworm; dsa · sudo · debian · 12

[Debian 13 (Trixie)]

  • Source package: [sudo]

    Details (2)
    • 1.9.16p2-3+deb13u2 · all · trixie

      Fixed · Fixed: 1.9.5p1-1.1

      dsa · sudo · debian · 13

    • 1.9.16p2-3+deb13u2 · all · trixie

      Fixed · Fixed: 1.9.5p1-1.1

      dsa · sudo · debian · 13

  • [sudo]Fixed
    Details (2)
    • 1.9.16p2-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 1.9.5p1-1.1

      dsa · sudo · debian · 13

    • 1.9.16p2-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 1.9.5p1-1.1

      dsa · sudo · debian · 13

  • [sudo-ldap]Fixed

    Source package: [sudo]

    Details (2)
    • 1.9.16p2-3+deb13u2 · amd64 · trixie

      Fixed · Fixed: 1.9.5p1-1.1

      dsa · sudo · debian · 13

    • 1.9.16p2-3+deb13u2 · arm64 · trixie

      Fixed · Fixed: 1.9.5p1-1.1

      dsa · sudo · debian · 13

Observed:

References