Key Information Vulnerability Overview Vulnerability Name: Sudo Host Option Elevation of Privilege CVE ID: CVE-2021-3156 Discovery Date: January 26, 2021 Affected Scope Affected Versions: - Sudo 1.8.2 - 1.8.30p3 - Sudo 1.9.0 - 1.9.5p1 Unaffected Versions: - Sudo 1.8.31 and above - Sudo 1.9.5p2 and above Vulnerability Description Issue: Under specific conditions, if the option in Sudo is misconfigured, a low-privileged user may escalate privileges by specifying a hostname. Exploitation Conditions: - The file contains specific and configurations. - The user can control the hostname or IP address. Exploitation Example Remediation Recommendations Upgrade Sudo: Upgrade to at least version 1.8.31 or higher. Reference Documentation: https://www.sudo.ws/security.html Disclosure Timeline 2021-01-26: Vulnerability discovered and reported. 2021-01-27: Initial report submitted to Sudo maintainers. 2021-01-28: Vulnerability confirmed and fix work initiated. 2021-01-29: Patch released and advisory published. Acknowledgments Discoverer: Todd Miller (Sudo author) Contributors: Stratascale team