CVE-2021-33909: Integer Overflow

An out-of-bounds write flaw was found in the seqfile in Filesystem layer, where a local attacker with a user privilege could gain access to out-of-bound memory leading to a system crash or a leak of internal kernel information. The issue results from not validating the sizet-to-int conversion prior to performing operations. The highest threat from this vulnerability is to data integrity, confidentiality and system availability.

While creating, mounting, and deleting a deep directory structure whose total path length exceeds 1GB, an unprivileged local attacker can write the 10-byte string "//deleted" to an offset of exactly -2GB-10B below the beginning of a vmalloc()ated kernel buffer.

References: https://www.openwall.com/lists/oss-security/2021/07/20/1 https://www.qualys.com/2021/07/20/cve-2021-33909/sequoia-local-privilege-escalation-linux.txt

Fix: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8cae8cd89f05f6de223d63e6d15e31c8ba9cf53b

— Red Hat

fs/seqfile.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.

Linux Kernel could allow a local attacker to gain elevated privileges on the system, caused by an out-of-bounds write in fs/seqfile.c. By sending a specially-crafted request, an attacker could exploit this vulnerability to escalate privileges to root.

— IBM