Listen to this Post
The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a use-after-free flaw in the Linux kernel’s filesystem layer. The issue resides in the `seq_file` interface’s handling of excessively long command-line arguments and environment strings. When a system call triggers the `seq_file` interface to output these strings, the `seq_buf_puts()` function copies user-supplied data into a buffer. If the aggregate size of the arguments and environment variables surpasses 2GB, it causes an integer overflow in the `size` parameter of seq_buf_puts(). This overflow leads to an undersized buffer allocation. Subsequent operations write beyond the allocated buffer’s bounds, corrupting adjacent kernel memory objects and freeing them. However, the `seq_file` interface retains a reference to the now-freed memory, enabling a local attacker to manipulate this freed object to execute arbitrary code with elevated kernel privileges.
Platform: Linux Kernel
Version: 3.16-5.13
Vulnerability: Use-After-Free
Severity: Critical
date: 2021-07-20
Prediction: 2021-07-27
What Undercode Say:
`cat /proc/self/attr/current | seq_file`
`./exploit /usr/bin/pkexec`
`dmesg | grep seq_buf_puts`
How Exploit:
Local privilege escalation via crafted `argv` and `envp` to trigger integer overflow and UAF in fs/seq_file.c.
Protection from this CVE
Apply kernel patch. Restrict access to vulnerable `procfs` files.
Impact:
Local privilege escalation to root. Full system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
