Listen to this Post
The CVE-2021-33909 vulnerability, also known as “Sequoia,” is a critical use-after-free flaw in the Linux kernel’s filesystem layer. The issue resides in the `seq_file` interface, which is used for producing files for the `/proc` filesystem. The vulnerability is triggered when a user writes a large number of 32-bit mount IDs to the `/proc/self/mountinfo` file. A race condition can occur between the `mount` and `umount` system calls. When `umount` is called on a filesystem, the associated `struct mount` object is freed. However, if a concurrent `read` operation on `/proc/self/mountinfo` is in progress, the kernel may retain a pointer to the already-freed `struct mount` object. This results in a use-after-free condition, where subsequent operations on the dangling pointer can corrupt kernel memory. An unprivileged local attacker can exploit this to achieve arbitrary code execution with kernel privileges, leading to a full system compromise.
Platform: Linux Kernel
Version: 3.16 to 5.13
Vulnerability: Use-After-Free
Severity: Critical
date: 2021-07-20
Prediction: Patch expected by 2021-07-27
What Undercode Say:
cat /proc/self/mountinfo grep -i "seq_file" /proc/kallsyms dmesg | grep "BUG: KASAN: use-after-free"
// Concept code showing the race
int main() {
while(1) {
if (fork() == 0) {
int fd = open("/proc/self/mountinfo", O_RDONLY);
read(fd, buf, sizeof(buf));
close(fd);
exit(0);
}
// In parallel, trigger mount/umount cycles
umount("/mnt/target");
mount("/dev/loop0", "/mnt/target", "ext4", 0, NULL);
}
}
How Exploit:
1. Attacker triggers concurrent reads on `/proc/self/mountinfo`.
- Simultaneously, attacker rapidly mounts and unmounts a filesystem.
3. The `umount` frees the `struct mount` object.
- The dangling pointer in the `seq_file` operation is used.
5. Attacker overwrites freed memory with controlled data.
- Kernel code execution is achieved, elevating privileges to root.
Protection from this CVE
Update the Linux kernel to version 5.13.4 or later.
Apply security patches from your distribution vendor (e.g., Ubuntu, Red Hat).
Restrict user namespaces if not required (`kernel.unprivileged_userns_clone=0`).
Impact:
Full system compromise, escalation of privileges from an unprivileged user to root (kernel-level), bypassing all security restrictions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
