CVE-2011-2189: High severity linux kernel vulnerability
It was found that vsftpd, Very Secure FTP daemon, when the network namespace (CONFIGNETNS) support was activated in the kernel, used to create a new network namespace per connection. A remote attacker could use this flaw to cause memory pressure (kernel OOM killer protection mechanism to be activated and potentially terminate vsftpd or arbitrary [vsftpd independent] process, which satisfied the OOM killer process selection algorithm).
References: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629373 [2] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/720095
Public PoC (from [2]): ======================
The test is started in this way:
$ for i in 1 2 3 4 5 6 7 8 ; do ./feedftp $i >/dev/null & done
What is observed during the test is that /proc/vmallocinfo grows continually with lines like the following being added:
0xffffe8ffff800000-0xffffe8ffffa00000 2097152 pcpugetvmareas+0x0/0x790 vmalloc 0xffffe8ffffa00000-0xffffe8ffffc00000 2097152 pcpugetvmareas+0x0/0x790 vmalloc 0xffffe8ffffc00000-0xffffe8ffffe00000 2097152 pcpugetvmareas+0x0/0x790 vmalloc
vsftpd bug: https://bugzilla.redhat.com/showbug.cgi?id=711134
Proposed patches (but has connection rates problem): http://patchwork.ozlabs.org/patch/88217/
Other sources
net/core/netnamespace.c in the Linux kernel 2.6.32 and earlier does not properly handle a high rate of creation and cleanup of network namespaces, which makes it easier for remote attackers to cause a denial of service (memory consumption) via requests to a daemon that requires a separate namespace per connection, as demonstrated by vsftpd.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2189?
CVE-2011-2189 has a medium severity rating due to the potential for denial of service through memory pressure.
How do I fix CVE-2011-2189?
To fix CVE-2011-2189, users should update their vsftpd installation to the latest version that addresses this vulnerability.
What software is affected by CVE-2011-2189?
CVE-2011-2189 affects various versions of the Linux kernel and specific distributions like Red Hat Enterprise Linux, Ubuntu Linux, and Debian Linux.
How does CVE-2011-2189 impact system security?
CVE-2011-2189 can cause the kernel OOM killer to activate, potentially leading to system instability or denial of service.
Who can exploit CVE-2011-2189?
A remote attacker can exploit CVE-2011-2189 by initiating multiple connections to the vsftpd server.