Security researchers from Qualys have disclosed details of two vulnerabilities affecting the Linux kernel and the system manager systemd. The kernel vulnerability (CVE-2021-33909) allows a local user to execute code with root privileges through manipulation of deeply nested directories. <\/p>\n
The risk of the vulnerability is heightened by the fact that researchers have managed to prepare working exploits that function in Ubuntu 20.04\/20.10\/21.04, Debian 11, and Fedora 34 in default configurations. It is noted that other distributions have not been tested but could theoretically also be affected and attacked. The full exploit code is promised to be published after the issue is widely addressed, meanwhile, only a limited-functionality prototype is available that causes system crashes. The issue has been present since July 2014 and affects kernel releases starting from 3.16. The vulnerability fix was coordinated with the community and incorporated into the kernel on July 19. Major distributions have already formed package updates with the kernel (Debian, Ubuntu, Fedora, RHEL, SUSE, Arch). <\/p>\n
The vulnerability arises from the lack of checking the result of the conversion from size_t to int before performing operations in the seq_file code, which creates files from a sequence of records. The absence of such checks may lead to writing outside the buffer boundaries when creating, mounting, and deleting directory structures with a very high level of nesting (path size exceeding 1 GB). Consequently, an attacker can achieve writing a 10-byte string '\/\/\/deleted' with an offset of '- 2 GB - 10 bytes', pointing to the area immediately preceding the allocated buffer. <\/p>\n
The prepared exploit requires 5 GB of memory and 1 million free inodes to operate. The exploit works by creating a hierarchy of about a million nested directories via the mkdir() call to reach a file path size exceeding 1 GB. This directory is mounted via bind-mount in a separate user namespace, after which the rmdir() function is invoked to delete it. Simultaneously, a thread is created that loads a small eBPF program, which gets blocked after checking the eBPF pseudocode, but before its JIT compilation. <\/p>\n
In an unprivileged user namespace, the file \/proc\/self\/mountinfo is opened, and a long path of the directory mounted via bind-mount is read, resulting in writing the string '\/\/\/deleted' in the area before the buffer starts. The position for writing this string is chosen such that it overwrites an instruction in an already checked but not yet compiled eBPF program. <\/p>\n
Next, at the eBPF program level, the uncontrolled write outside the buffer is transformed into a controlled ability to read and write into other kernel structures by manipulating the btf and map_push_elem structures. As a result, the exploit determines the location of the modprobe_path[] buffer in kernel memory and overwrites it with the path '\/sbin\/modprobe', which allows the initiation of any executable file with root privileges when the request_module() call is made, for example, when creating a netlink socket. <\/p>\n
Researchers suggest several workarounds that are effective only for specific exploits but do not eliminate the issue itself. It is recommended to set the parameter '\/proc\/sys\/kernel\/unprivileged_userns_clone' to 0 to prohibit mounting directories in a separate user namespace, as well as '\/proc\/sys\/kernel\/unprivileged_bpf_disabled' to 1 to prevent loading eBPF programs into the kernel.