Listen to this Post
The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a use-after-free flaw in the Linux kernel’s sequence file system operation. The issue resides in the `fs/seq_file.c` file. The `seq_open()` function allocates a `struct seq_file` when a file is opened. This structure contains a buffer pointer. The vulnerability is triggered when a user mounts a filesystem with a pathname exceeding the system’s maximum allowed size (defined by PATH_MAX). This causes the `seq_buf_alloc()` function to fail, returning a null pointer, which is then assigned to the buffer. However, the `seq_release()` function later attempts to free this null pointer via kfree(), which was mistakenly not checked for null. This results in a kernel panic, crashing the entire system and leading to a denial of service condition. The flaw is exploitable by an unprivileged local user.
Platform: Linux Kernel
Version: All versions before 5.13.4
Vulnerability: Use-After-Free
Severity: Critical
date: 2021-07-20
Prediction: 2021-07-27
What Undercode Say:
`cat /proc/self/mountinfo | grep -E ‘path.[>4096 characters]’`
`dmesg | grep -i “segmentation fault”`
`uname -r`
How Exploit:
`python3 sequoia_exploit.py`
Protection from this CVE
Update kernel to version 5.13.4 or later.
Impact:
Denial of Service (System Crash)
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
