Sequoia Vulnerability (CVE-2021-33909), PCI DSS Experts advise

An out-of-bounds write flaw was found in the Linux kernel's seq_file in the Filesystem layer. This flaw allows a local attacker with a user privilege to gain access to out-of-bound memory, leading to a system crash or a leak of internal kernel information. The issue results from not validating the size_t-to-int conversion prior to performing operations.

From PCI DSS point of view, primary concerns are operating system user account security. Verification on the necessities of allowing access given to System, restrict only the mandatory rights to login with logging, eBPF etc. Patch management, especially critical, should be complete in 30 days.

PCI DSS Requirement 2.1

Always change vendor-supplied defaults and remove or disable unnecessary default accounts before installing a system on the network. Verify /etc/passwd has proper settings; delete or set to "nologin", preventing non-mandatory users from logging in using the vulnerability to compromise the system.

PCI DSS Requirement 6.2

Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches. Install critical security patches within one month of release.

Verify Operating System vendors have released related patches and complete patch update within 1 month. If there are no updates from the vendors, a necessary mitigation process should be in place.

Patch listing (noted by Qualys Security Research Team)

• NESSUS — tenable.com/cve/CVE-2021-33909 · CVSS (v2) 7.2
• NIST NVD — nvd.nist.gov/vuln/detail/CVE-2021-33909 · CVSS (v3) 7.8
• Redhat — access.redhat.com/security/cve/cve-2021-33909 · CVSS (v3) 7.0
• CVE — cve.mitre.org (Source: MITRE)

Update on 2021/09/10

Qualys Security Research Team has proven the vulnerability by accessing root rights in vulnerable OS of: Ubuntu 20.04, Ubuntu 20.10, Ubuntu 21.04, Debian 11 and Fedora 34 Workstation. Other Linux OS may result in I.O.C. generated from this vulnerability. Linux Server patch fixes: Redhat, CentOS, SUSE, Ubuntu security advisories (see vendor pages).

If there are no updates from the vendors, necessary mitigation process should be in place:

• sysctl kernel.unprivileged_userns_clone=1 → set unprivileged_userns_clone as 0
• sysctl kernel.unprivileged_bpf_disabled=1 → set unprivileged_bpf_disabled as 1

For technical details, please refer to: Qualys Sequoia advisory