CVE-2011-1082: Medium severity linux kernel vulnerability
Description of problem: In several places, an epoll fd can call another file's ->fop->poll() method with ep->mtx held. This is in general unsafe, because that other file could itself be an epoll fd that contains the original epoll fd.
The code defends against this possibility in its own ->poll() method using epcallnested, but there are several other unsafe calls to ->poll elsewhere that can be made to deadlock. For example, the following simple program causes the call in epinsert recursively call the original fd's ->poll, leading to deadlock
References: https://lkml.org/lkml/2011/2/5/220 http://seclists.org/oss-sec/2011/q1/337
Upstream commit: http://git.kernel.org/linus/22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e
Acknowledgements:
Red Hat would like to thank Nelson Elhage for reporting this issue.
Other sources
fs/eventpoll.c in the Linux kernel before 2.6.38 places epoll file descriptors within other epoll data structures without properly checking for (1) closed loops or (2) deep chains, which allows local users to cause a denial of service (deadlock or stack memory consumption) via a crafted application that makes epollcreate and epollctl system calls.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1082?
CVE-2011-1082 is classified as a medium severity vulnerability due to the risks it poses to system stability and potential denial-of-service scenarios.
How do I fix CVE-2011-1082?
To fix CVE-2011-1082, upgrade to a kernel version later than 2.6.38 that addresses this vulnerability.
What are the potential impacts of CVE-2011-1082?
The potential impacts of CVE-2011-1082 include system crashes and instability due to unsafe polling operations involving epoll file descriptors.
Which systems are affected by CVE-2011-1082?
CVE-2011-1082 affects versions of the Linux kernel prior to 2.6.38.
Is CVE-2011-1082 easy to exploit?
Exploitation of CVE-2011-1082 requires specific conditions and knowledge of the system's file descriptor operations, making it moderately difficult to exploit.