Sequoia: A Local Privilege Escalation Vulnerability in Linux’s Filesystem Layer (CVE-2021-33909) | Qualys
Summary: Qualys researchers found a size_t-to-int type conversion flaw in the Linux kernel's seq_file interface, tracked as CVE-2021-33909, that lets any unprivileged user gain root on a vulnerable host in a default configuration. Qualys verified an exploit and obtained full root on default installs of Ubuntu 20.04, 20.10, 21.04, Debian 11, and Fedora 34 Workstation, and states all Linux kernel versions from 2014 onwards are vulnerable.
Bottom line: An unprivileged local user becomes root by creating, mounting, and deleting a directory tree whose path exceeds 1GB and reading /proc/self/mountinfo, and Qualys says the mitigations it lists stop only its specific exploit, so the kernel must be patched.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-33909
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026