CVE-2021-33909
- State
- Published
- Severity
- Not scored
- Published
- Jul 20, 2021
- Updated
- Aug 4, 2024
- Reserved
- Jun 7, 2021
Description
fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- [debian-lts-announce] 20210720 [SECURITY] [DLA 2713-2] linux security updatemailing-list
- [debian-lts-announce] 20210720 [SECURITY] [DLA 2713-1] linux security updatemailing-list
- [debian-lts-announce] 20210720 [SECURITY] [DLA 2714-1] linux-4.19 security updatemailing-list
- DSA-4941vendor-advisory
- FEDORA-2021-07dc0b3eb1vendor-advisory
- [oss-security] 20210722 Re: CVE-2021-33909: size_t-to-int vulnerability in Linux's filesystem layermailing-list
- [oss-security] 20210825 Re: CVE-2021-33909: size_t-to-int vulnerability in Linux's filesystem layermailing-list
- [oss-security] 20210916 Containers-optimized OS (COS) membership in the linux-distros listmailing-list
- [oss-security] 20210917 Re: Containers-optimized OS (COS) membership in the linux-distros listmailing-list
- [oss-security] 20210920 Re: Containers-optimized OS (COS) membership in the linux-distros listmailing-list
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.openwall.com/lists/oss-security/2021/07/20/1
- https://github.com/torvalds/linux/commit/8cae8cd89f05f6de223d63e6d15e31c8ba9cf53b
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.4
- http://packetstormsecurity.com/files/163621/Sequoia-A-Deep-Root-In-Linuxs-Filesystem-Layer.html
- http://packetstormsecurity.com/files/163671/Kernel-Live-Patch-Security-Notice-LSN-0079-1.html
- https://security.netapp.com/advisory/ntap-20210819-0004/
- http://packetstormsecurity.com/files/164155/Kernel-Live-Patch-Security-Notice-LSN-0081-1.html
- http://packetstormsecurity.com/files/165477/Kernel-Live-Patch-Security-Notice-LSN-0083-1.html
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0015
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.