RHSB-2021-006 Long path name in mountpoint flaws in the kernel and systemd (CVE-2021-33909, CVE-2021-33910)

Executive Summary

Red Hat is aware of two flaws caused by the incorrect handling of long path names. The first vulnerability is found within the Linux kernel, where a local attacker can escalate privileges and is assigned CVE-2021-33909. The second vulnerability is found in systemd, where a local attacker can crash systemd and the entire system and is assigned CVE-2021-33910.

Both flaws have a severity impact rating of Important.

The following Red Hat product versions are directly affected by CVE-2021-33909:

• Red Hat Enterprise Linux 8

• Red Hat Enterprise Linux 7

• Red Hat Enterprise Linux 6

The following Red Hat product versions are directly affected by CVE-2021-33910:

• Red Hat Enterprise Linux 8

Further, any Red Hat product supported on Red Hat Enterprise Linux (including RHEL CoreOS) is also potentially impacted. This includes:

• Product containers based on the RHEL or UBI container images. Base images will be updated to include fixes for this flaw, please ensure containers are current. The Container Health Index, part of the Red Hat Container Catalog, can be used to verify the security status of Red Hat containers.

• Products that pull packages from the RHEL channel (this includes layered products such as OpenShift Container Platform, OpenStack, Red Hat Virtualization, and others). Please ensure that the underlying RHEL kernel and systemd packages are current in these product environments.

To determine if your system is currently vulnerable to these flaws, see the Diagnose section below.

Technical Summary

These two vulnerabilities exploit conditions when files with a long path are not handled correctly.

The first vulnerability (CVE-2021-33909) is an attack against the Linux kernel. An unprivileged local attacker can exploit this vulnerability by creating, mounting, and deleting a deep directory structure whose total path length exceeds 1GB. A successful attack results in privilege escalation.

The second vulnerability (CVE-2021-33910) is an attack against systemd (the system and service manager) and requires a local attacker with the ability to mount a filesystem with a long path. This attack causes systemd, the services it manages, and the entire system to crash and stop responding.

Mitigation

Red Hat has investigated whether possible mitigation exists for this issue and has not been able to identify a practical example. Please update the affected package as soon as possible.

Technical Details

Researchers reported the following two vulnerabilities. A short description of each flaw and its impact are listed below. 

CVE-2021-33909

An out-of-bounds write flaw was found in the Linux kernel's seq_file in the Filesystem layer. This flaw allows a local attacker with a user privilege to gain access to out-of-bound memory, leading to a system crash or a leak of internal kernel information. The issue results from not validating the size_t-to-int conversion prior to performing operations. 

This vulnerability is a type conversion vulnerability in the filesystem layer of the Linux kernel. A type conversion vulnerability is a condition when converting between two types and can lead to an overflow, creating a large negative value.

An attacker must be able to:

• Create a long path

• Mount a filesystem at this location

• Delete the mount point

• Read the /proc/<pid>/mountinfo file

This issue will be triggered, resulting in writing over kernel memory at a controllable offset.

The mountinfo file is an example of a seq_file, which is a virtual file through which the kernel presents a sequence of records. Each record must fit into a seq_file buffer, whose size is tracked as a size_t (a 64-bit unsigned value). The problem manifests when a very long mountpoint path is used in the show_mountinfo function.  

This process expects an int as the buffer length (a 32-bit signed value) as shown below: 

show_mountinfo() -> seq_dentry() -> dentry_path((.. , .. , int buflen) 

Note that “buflen” may cause a size_t-to-int conversion problem, transforming the number to a negative value and later causing an out-of-bounds access vulnerability.     

When the mountpoint is still in use but the path has been deleted, the incorrectly calculated value is used as an offset to write the string “//deleted” outside the allocated buffer. Because the value is negative, it writes to a location between 2GB and 10 bytes before the intended buffer location.

Writing at this offset creates a denial of service, crashes the system, and causes memory corruption or privilege escalation by targeting specific memory locations.

CVE-2021-33910

A flaw was found in systemd. The use of alloca function with an uncontrolled size in function unit_name_path_escape allows a local attacker, able to mount a filesystem on a very long path, to crash systemd and the whole system by allocating a very large space in the stack.

This is an attacker-controlled alloca() in systemd, which allows a local attacker to crash the systemd service (PID 1) and the entire system. Alloca() is used to allocate space required by a program on the stack. It should not be used when the requested size is controlled by a user or when it is too large, as otherwise, the program may write outside of the allocated stack space and crash. 

Systemd constantly monitors the /proc/self/mountinfo file to get details about mounted filesystems and internally duplicates the mount point string using alloca(). If an attacker can mount a filesystem on a very long path (ex. by using FUSE), they may trigger this issue and crash the system.

This issue did not affect the versions of systemd as shipped with Red Hat Enterprise Linux 7 as they did not use strdupa(), which uses alloca() underneath, to duplicate strings in the unit_name_path_escape() function, but strdup(), which allocates space on the heap.

Affected Red Hat products by CVE

Updates for affected products

Red Hat customers running affected versions of these Red Hat products are strongly recommended to update as soon as errata are available. Customers are urged to apply the available updates immediately and enable the mitigations as they feel appropriate.  

[1] Advisory/Update link will be added once updates are live.

[2] What is the Red Hat Enterprise Linux Extended Update Support (EUS) Subscription?

[3] What is Advanced mission critical Update Support (AUS)?

[4] What is the Red Hat Enterprise Linux SAP Solutions subscription?

[5] An active Extended Life-cycle Support (ELS) subscription is required for access to this patch. Please contact Red Hat sales or your specific sales representative for more information if your account does not have an active ELS subscription.

Diagnose

A vulnerability detection script has been developed to determine if your system is currently vulnerable to this flaw. To verify the authenticity of the script, you can download the detached GPG signature as well. Instructions on how to use GPG signature for verification are available on the Customer Portal. 

Acknowledgements

Red Hat thanks the Qualys Research Team for reporting these vulnerabilities.

References

https://access.redhat.com/security/cve/cve-2021-33909

https://access.redhat.com/security/cve/cve-2021-33910

https://www.qualys.com/2021/07/20/cve-2021-33909/sequoia-local-privilege-escalation-linux.txt

https://www.qualys.com/2021/07/20/cve-2021-33910/denial-of-service-systemd.txt

​​​​​​​How to use GPG to verify signed content from Product Security