🟠 High | Source: GCP Compute Engine Security Bulletins
A heap-based buffer overflow vulnerability in the Linux ‘sudo’ utility (CVE-2021-3156) allows an unprivileged local user to gain root access on affected systems. GCP’s underlying Compute Engine infrastructure is not directly affected, but Linux-based Compute Engine VMs with sudo installed are at risk. Organisations running unpatched guest operating systems should treat this as an urgent remediation task.
Security Architect’s Take: Audit all Compute Engine VM images for unpatched sudo versions and prioritise OS-level patching or image replacement immediately — for Container-Optimized OS, update to cos-85-13310-1209-7, cos-81-12871-1245-6, or cos-dev-89-16091-0-0 as a minimum. Consider enforcing automated OS patch management policies via OS Config to prevent similar gaps at scale.
Original advisory: GCP-2021-001