Listen to this Post
The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a critical use-after-free flaw in the Linux kernel’s filesystem layer. The issue resides in the `seq_file` interface, which is used for producing files for the `/proc` filesystem. The vulnerability is triggered when a user writes a large size value to `/proc/self/mountinfo` or other seq_file handled proc files. The `mountinfo_show()` function uses the `m_start()` function to acquire a `struct seq_file` which contains a buffer pointer. By manipulating the size, an attacker can cause a buffer overflow in the `seq_read_iter()` function. This overflow corrupts the `seq_file` object, specifically the `buf` pointer. Subsequent operations on the corrupted object lead to a use-after-free condition where the kernel attempts to read from or write to a memory location that has already been freed and potentially reallocated with attacker-controlled data. This memory corruption can be leveraged for local privilege escalation, granting a unprivileged user root access on the vulnerable system.
Platform: Linux Kernel
Version: 3.16 to 5.13.x
Vulnerability: Use-After-Free
Severity: Critical
date: 2021-07-20
Prediction: 2021-07-27
What Undercode Say:
`echo ‘aaaaaaaa’ > /proc/self/mountinfo`
`dmesg | grep -i “seq_file”`
`cat /proc/sys/kernel/overflowgid`
`grep -r “seq_operations” /usr/src/linux-headers-$(uname -r)/fs/`
How Exploit:
Local Privilege Escalation via memory corruption.
Protection from this CVE
Update kernel to version 5.13.4 or apply security patch.
Impact:
Full system compromise, root access from unprivileged user.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
