CVE-2021-33909

fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

9.73% chance of exploitation in the next 30 days, 95th percentile

Published

2021-07-20

Updated

2024-08-04

Proof-of-concept exploits (7)

• http://packetstormsecurity.com/files/163621/Sequoia-A-Deep-Root-In-Linuxs-Filesystem-Laye…
• https://www.openwall.com/lists/oss-security/2021/07/20/1
• ChoKyuWon/exploit_articles2★ · 2021-07-30
• ChrisTheCoolHut/CVE-2021-3390944★ · 2021-09-02
• Liang2580/CVE-2021-3390977★ · 2021-07-20
• baerwolf/cve-2021-339096★ · 2021-07-25
• bbinfosec43/CVE-2021-339095★ · 2021-07-26

References

• CVE Record
• NVD entry

Related

• CVE-2021-22555
• CVE-2021-31440
• CVE-2021-37580
• CVE-2021-33904
• CVE-2021-33910
• CVE-2021-33887