Listen to this Post
The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a use-after-free flaw in the Linux kernel’s sequence file system operation functionality. The issue resides in the `fs/seq_file.c` file. When a user creates a large directory structure with deep paths, the `seq_operations` structure, which holds function pointers for file operations, can be freed from memory while still being in use. This occurs because the `single_start()` function, which manages the reading of files in the `/proc` filesystem, fails to properly handle an error condition (specifically, an integer overflow when calculating the total size of a path). If the `seq_read_iter()` function encounters an error, it calls seq_release(), which frees the `seq_operations` structure. However, the error handling code in `single_start()` does not clear the pointer to this now-freed structure. A subsequent attempt to use the file descriptor leads to the kernel dereferencing the freed function pointers, allowing a local attacker to execute arbitrary code with kernel privileges.
Platform: Linux Kernel
Version: 3.16 to 5.13
Vulnerability: Use-After-Free
Severity: Critical
date: 2021-07-20
Prediction: 2021-07-27
What Undercode Say:
`cat /proc/self/mountinfo`
`ls -la /proc//fd/`
`dmesg | grep -i “seq_file”`
`for i in {1..1000}; do mkdir $i; cd $i; done; cat /proc/self/mountinfo`
How Exploit:
`./sequoia_exploit /tmp/payload`
`gcc poc.c -o exploit`
`./exploit`
Protection from this CVE
Update kernel to version 5.13.4 or later. Apply vendor patches. Restrict access to privileged commands.
Impact:
Local Privilege Escalation to root. Complete system compromise. Kernel memory corruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
