Linux kernel (seq_file / fs layer): Sequoia: size_t-to-int conversion in the filesystem layer, local root on default

Impact

Sequoia: size_t-to-int conversion in the filesystem layer, local root on default configs

Who can reach it

Local user / tenant process able to mount or traverse deep paths

What to do

Livepatchable; otherwise drain + reboot

References

Related entries

• Linux kernel (eBPF verifier): eBPF ALU32 bitwise-op bounds tracking flawCVE-2021-3490 · Linux kernel (eBPF verifier)High
• polkit: Local privilege escalation via polkit_system_bus_name_get_creds_sync() raceCVE-2021-3560 · polkitHigh
• polkit (pkexec): PwnKit: local privilege escalation to root via argv handlingCVE-2021-4034 · polkit (pkexec)High
• Linux kernel (net/smc): The CDC send-completion handler takes a lock inside an smc_sock that close() has already freedCVE-2021-46925 · Linux kernel (net/smc)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amd/amdkfd): A correctness defect in the amdkfd (KFD computeCVE-2021-47551 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amd/amdkfd)High
• Linux kernel (arch/x86/kvm/mmu): The TDP MMU skipped invalid roots when unmapping a GFN range, so KVM could still holdCVE-2021-47639 · Linux kernel (arch/x86/kvm/mmu)High