CVE-2021-33909Integer Overflow or Wraparound in Kernel

Severity
7.8HIGHNVD
OSV3.5
EPSS
2.2%
top 15.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJul 20
Latest updateMay 24

Description

fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

NVDlinux/linux_kernel3.12.433.13+8
Debianlinux/linux_kernel< 5.10.46-2+3
Ubuntulinux/linux_kernel< 4.15.0-151.157
NVDsonicwall/sma1000_firmware12.4.2-02044

Also affects: Debian Linux 10.0, 9.0, Fedora 34

Patches

🔴Vulnerability Details

7
GHSA
GHSA-6g4v-3wmh-w3jg: fs/seq_file2022-05-24
OSV
linux-oem-5.10 vulnerabilities2021-07-20
OSV
linux, linux-aws, linux-aws-5.8, linux-azure, linux-azure-5.8, linux-gcp, linux-gcp-5.8, linux-hwe-5.8, linux-kvm, linux-oracle, linux-oracle-5.8, linux-raspi vulnerabilities2021-07-20
CVEList
CVE-2021-33909: fs/seq_file2021-07-20
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities2021-07-20

📋Vendor Advisories

13
Oracle
Oracle Oracle Communications Risk Matrix: Core (Kernel) — CVE-2021-339092022-01-15
Ubuntu
Kernel Live Patch Security Notice2022-01-06
Android
CVE-2021-33909: Filesystem2021-12-01
Ubuntu
Kernel Live Patch Security Notice2021-09-13
Ubuntu
Kernel Live Patch Security Notice2021-07-26

🕵️Threat Intelligence

1
Qualys
Sequoia: A Local Privilege Escalation Vulnerability in Linux’s Filesystem Layer (CVE-2021-33909) | Qualys2021-07-20
CVE-2021-33909 — Integer Overflow or Wraparound | cvebase