Bug 1970273 (CVE-2021-33909)

Summary:	CVE-2021-33909 kernel: size_t-to-int conversion vulnerability in the filesystem layer
Product:	[Other] Security Response	Reporter:	Rohit Keshri <rkeshri>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	acaringi, adscvr, agk, airlied, alciregi, aromito, asavkov, aviro, bhu, blc, bmasney, brdeoliv, bskeggs, chwhite, crwood, ctoe, dblechte, dfediuck, dhoward, dhowells, dvlasenk, dwalsh, eedri, esandeen, fcanogab, fhrbata, fpacheco, germano.massullo, gpei, hdegoede, hkrzesin, ikent, jarod, jarodwilson, jeremy, jforbes, jglisse, jhou, jlelli, joe.lawrence, jonathan, josef, jpoimboe, jshortt, jstancek, jthierry, jwboyer, kcarcia, kernel-maint, kernel-mgr, kpatch-maint, lgoncalv, linville, masami256, mchehab, mgoldboi, michal.skrivanek, mjobanek, mlangsdo, mpatel, mszeredi, mvanderw, nmurray, nobody, pmatouse, proguski, ptalbert, qzhao, rhandlin, rphillips, rvrbovsk, sbonazzo, security-response-team, sherold, steved, sttts, swhiteho, walters, wcosta, williams, wmealing, wsun, xzhou, ycote, yturgema
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 5.14 rc3	Doc Type:	If docs needed, set a value
Doc Text:	An out-of-bounds write flaw was found in the Linux kernel's seq_file in the Filesystem layer. This flaw allows a local attacker with a user privilege to gain access to out-of-bound memory, leading to a system crash, leak of internal kernel information and can escalate privileges. The issue results from not validating the size_t-to-int conversion prior to performing operations. The highest threat from this vulnerability is to data integrity, confidentiality and system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-07-20 21:54:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1976738, 1970317, 1970318, 1970788, 1974125, 1974126, 1975179, 1975180, 1975181, 1975182, 1975184, 1975185, 1975186, 1975187, 1975188, 1975189, 1975190, 1975246, 1975247, 1975248, 1975249, 1975250, 1975251, 1975252, 1975253, 1975254, 1975255, 1975256, 1975617, 1975777, 1975778, 1976739, 1976740, 1976741, 1977570, 1977574, 1984019
Bug Blocks:	1969705

Description Rohit Keshri 2021-06-10 08:17:13 UTC

An out-of-bounds write flaw was found in the seq_file in Filesystem layer, where a local attacker with a user privilege could gain access to out-of-bound memory leading to a system crash or a leak of internal kernel information. The issue results from not validating the size_t-to-int conversion prior to performing operations. The highest threat from this vulnerability is to data integrity, confidentiality and system availability.

While creating, mounting, and deleting a deep directory structure whose total path length exceeds 1GB, an unprivileged local attacker can write the 10-byte string "//deleted" to an offset of exactly -2GB-10B below the beginning of a vmalloc()ated kernel buffer.

References:
https://www.openwall.com/lists/oss-security/2021/07/20/1
https://www.qualys.com/2021/07/20/cve-2021-33909/sequoia-local-privilege-escalation-linux.txt

Fix:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8cae8cd89f05f6de223d63e6d15e31c8ba9cf53b

Comment 18 Alexander Viro 2021-06-24 16:51:31 UTC

*shrug*
Just don't let the damn thing ask for vmalloc'ed buffer that large.
IOW, add to seq_buf_alloc() if (unlikely(size > MAX_RW_COUNT)) return NULL;
and be done with that.

Comment 63 Rohit Keshri 2021-07-20 12:43:04 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1984019]

Comment 66 errata-xmlrpc 2021-07-20 20:04:04 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.2 Advanced Update Support

Via RHSA-2021:2734 https://access.redhat.com/errata/RHSA-2021:2734

Comment 67 errata-xmlrpc 2021-07-20 20:21:00 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Advanced Update Support

Via RHSA-2021:2733 https://access.redhat.com/errata/RHSA-2021:2733

Comment 68 errata-xmlrpc 2021-07-20 20:54:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Extended Lifecycle Support

Via RHSA-2021:2735 https://access.redhat.com/errata/RHSA-2021:2735

Comment 69 errata-xmlrpc 2021-07-20 20:55:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:2715 https://access.redhat.com/errata/RHSA-2021:2715

Comment 70 errata-xmlrpc 2021-07-20 21:15:45 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Advanced Update Support
  Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.4 Telco Extended Update Support

Via RHSA-2021:2732 https://access.redhat.com/errata/RHSA-2021:2732

Comment 71 errata-xmlrpc 2021-07-20 21:20:54 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:2722 https://access.redhat.com/errata/RHSA-2021:2722

Comment 72 errata-xmlrpc 2021-07-20 21:24:49 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Advanced Update Support
  Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.6 Telco Extended Update Support

Via RHSA-2021:2730 https://access.redhat.com/errata/RHSA-2021:2730

Comment 73 errata-xmlrpc 2021-07-20 21:27:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:2719 https://access.redhat.com/errata/RHSA-2021:2719

Comment 74 Product Security DevOps Team 2021-07-20 21:54:40 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-33909

Comment 75 errata-xmlrpc 2021-07-20 22:10:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:2718 https://access.redhat.com/errata/RHSA-2021:2718

Comment 76 errata-xmlrpc 2021-07-20 22:24:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:2723 https://access.redhat.com/errata/RHSA-2021:2723

Comment 77 errata-xmlrpc 2021-07-20 22:34:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:2714 https://access.redhat.com/errata/RHSA-2021:2714

Comment 78 errata-xmlrpc 2021-07-20 22:42:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:2727 https://access.redhat.com/errata/RHSA-2021:2727

Comment 79 errata-xmlrpc 2021-07-21 00:02:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions

Via RHSA-2021:2731 https://access.redhat.com/errata/RHSA-2021:2731

Comment 80 errata-xmlrpc 2021-07-21 00:12:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:2720 https://access.redhat.com/errata/RHSA-2021:2720

Comment 81 errata-xmlrpc 2021-07-21 00:14:21 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:2716 https://access.redhat.com/errata/RHSA-2021:2716

Comment 82 errata-xmlrpc 2021-07-21 00:28:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Extended Update Support

Via RHSA-2021:2729 https://access.redhat.com/errata/RHSA-2021:2729

Comment 83 errata-xmlrpc 2021-07-21 01:07:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:2725 https://access.redhat.com/errata/RHSA-2021:2725

Comment 84 errata-xmlrpc 2021-07-21 01:08:35 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:2726 https://access.redhat.com/errata/RHSA-2021:2726

Comment 85 errata-xmlrpc 2021-07-21 01:11:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Extended Update Support

Via RHSA-2021:2728 https://access.redhat.com/errata/RHSA-2021:2728

Comment 86 errata-xmlrpc 2021-07-21 14:09:24 UTC

This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2021:2737 https://access.redhat.com/errata/RHSA-2021:2737

Comment 88 errata-xmlrpc 2021-07-22 15:07:05 UTC

This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

Via RHSA-2021:2736 https://access.redhat.com/errata/RHSA-2021:2736

Comment 91 errata-xmlrpc 2021-07-26 16:40:32 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.7

Via RHSA-2021:2763 https://access.redhat.com/errata/RHSA-2021:2763