Listen to this Post
The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a use-after-free flaw in the Linux kernel’s filesystem layer. The issue resides in the `seq_file` interface’s handling of specially crafted filesystem paths. An attacker can exploit this by creating a directory structure with an extremely long path name, exceeding the limits of the `kmalloc()` allocator. When the `d_path()` function is called on this path, the allocation for the pathname buffer fails, returning an error. However, the `seq_file` interface does not properly handle this error condition and proceeds to use the previously allocated, now-freed buffer (a use-after-free) when outputting the pathname to user space. This corrupts the kernel’s memory, potentially allowing a local unprivileged user to escalate their privileges to root.
Platform: Linux Kernel
Version: 3.16 to 5.13
Vulnerability: Use-After-Free
Severity: Critical
date: 2021-07-20
Prediction: Patch Available
What Undercode Say:
`gcc exploit.c -o exploit`
`./exploit`
`mkdir -p $(python -c ‘print(“A”2000)’)/AAAAAAAAAA`
`cat /usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache`
How Exploit:
Local Privilege Escalation via crafted long path.
Protection from this CVE:
Update kernel to 5.13.4 or apply security patch.
Impact:
Privilege Escalation to root.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
