fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.
{
"fixes": [
"https://android.googlesource.com/kernel/common/+/8cae8cd89f05f6de223d63e6d15e31c8ba9cf53b"
],
"severity": "High",
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"74254866291374402956710747649521950744",
"80765060961419181796369186824257428641",
"30272898263732629582390626314069094611",
"249931424290703359451893110809274264261"
]
},
"signature_type": "Line",
"target": {
"file": "fs/seq_file.c"
},
"deprecated": false,
"source": "https://android.googlesource.com/kernel/common/+/8cae8cd89f05f6de223d63e6d15e31c8ba9cf53b",
"signature_version": "v1",
"id": "ASB-A-195082750-98f75c34"
},
{
"digest": {
"length": 101.0,
"function_hash": "33647813340154487149123856384192856444"
},
"signature_type": "Function",
"target": {
"function": "seq_buf_alloc",
"file": "fs/seq_file.c"
},
"deprecated": false,
"source": "https://android.googlesource.com/kernel/common/+/8cae8cd89f05f6de223d63e6d15e31c8ba9cf53b",
"signature_version": "v1",
"id": "ASB-A-195082750-da83d170"
}
],
"types": [
"EoP"
],
"spl": "2021-12-05"
}