macOS Big Sur 11.2.1 Fixes Root Access Sudo Bug

Tuesday February 9, 2021 11:32 am PST by Juli Clover

The macOS Big Sur 11.2.1 update that Apple released today fixes a sudo security vulnerability that could allow an attacker to gain root access to a Mac.

sudo bug macos
According to an Apple security support document, the bug, CVE-2021-3156, was addressed in the update by updating to sudo version 1.9.5p2. Apple has also fixed the bug in Supplemental Updates made available for macOS Catalina 10.15.7 and macOS Mojave 10.14.6.

The updates also include fixes for two bugs that could allow an app to execute arbitrary code with kernel privileges.

Discovered last week, the vulnerability triggers a "heap overflow" in sudo that changes the current user's privileges to enable root-level access, giving an attacker access to the entire system.

Popular Stories

Here's What Apple's Apps Look Like on the iPhone Duo

Tuesday October 20, 2026 11:12 am PDT by Juli Clover

With just three days to go until the iPhone Duo is released, Apple is getting ready for the launch. Behind the scenes, the App Store now has screenshots of Apple's built-in apps running on the Duo. We've seen some apps in marketing materials, but images of the ones we haven't seen give us an idea of what it will be like using the iPhone Duo day to day. Many apps are shown in landscape...

• 116 comments

Apple Pulls Keynote, Pages and Numbers From App Store [Update: Back]

Thursday October 22, 2026 11:01 am PDT by Juli Clover

Apple has temporarily removed Keynote, Pages, and Numbers from the App Store, just after releasing an update that added iPhone Duo support and a new Intelligent Assistant. It is not clear if the apps were removed intentionally, or if it is a bug. Apple has not said when the apps will be reinstated, but if it was in error, they should return soon. Update: The Mac versions are back without...

• 64 comments

RIP, MacBook Ultra

Monday October 19, 2026 9:37 am PDT by Joe Rossignol

Apple today sent out invites for an experience in Los Angeles on Wednesday, October 28, and the "Pro and tell" tagline on the invitation likely means that the rumored MacBook models with touch-enabled OLED displays will stick with MacBook Pro branding instead of the once-rumored "MacBook Ultra" name. The long-rumored "iPhone Ultra" ended up being named iPhone Duo, so speculation that Apple...

• 165 comments

Top Rated Comments

neuropsychguy

74 months ago

Is Apple the first? Did other Unix and Linux push out the update too?

Most major Linux distros have already fixed it.

Examples:
https://ubuntu.com/security/CVE-2021-3156
https://access.redhat.com/security/cve/cve-2021-3156
https://www.suse.com/security/cve/CVE-2021-3156/
https://bodhi.fedoraproject.org/updates/FEDORA-2021-2cb63d912a

Score: 6 Votes (Like | Disagree)

luvbug

74 months ago

Thank you! Much more than a charging bug, for sure.

Score: 6 Votes (Like | Disagree)

TriBruin

74 months ago

Now if it could just come standard with allowing us to use TouchID instead of typing our password.

You know that you can enable this feature. Unfortunately, it has to be re-enabled after each update.

https://derflounder.wordpress.com/2017/11/17/enabling-touch-id-authorization-for-sudo-on-macos-high-sierra/

Score: 5 Votes (Like | Disagree)

ruka.snow

74 months ago

Fantastic. Unlikely to affect me but still good to have the furniture nailed down.

Score: 4 Votes (Like | Disagree)

Jerry Fritschle

74 months ago

Reminds me of High Sierra. Waiting for the login “root” user access now. :p

I admit I thought of that, too. However, "sudo" is a utility found throughout unix/Linux systems. This was therefore not an "Apple" bug, but rather an update that had to come from upstream :-)

Score: 3 Votes (Like | Disagree)