CVE-2011-2189
First published: Mon Jun 06 2011(Updated: )
It was found that vsftpd, Very Secure FTP daemon, when the network namespace (CONFIG_NET_NS) support was activated in the kernel, used to create a new network namespace per connection. A remote attacker could use this flaw to cause memory pressure (kernel OOM killer protection mechanism to be activated and potentially terminate vsftpd or arbitrary [vsftpd independent] process, which satisfied the OOM killer process selection algorithm). References: [1] <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629373">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629373</a> [2] <a href="https://bugs.launchpad.net/ubuntu/+source/linux/+bug/720095">https://bugs.launchpad.net/ubuntu/+source/linux/+bug/720095</a> Public PoC (from [2]): ====================== The test is started in this way: $ for i in 1 2 3 4 5 6 7 8 ; do ./feedftp $i >/dev/null & done What is observed during the test is that /proc/vmallocinfo grows continually with lines like the following being added: 0xffffe8ffff800000-0xffffe8ffffa00000 2097152 pcpu_get_vm_areas+0x0/0x790 vmalloc 0xffffe8ffffa00000-0xffffe8ffffc00000 2097152 pcpu_get_vm_areas+0x0/0x790 vmalloc 0xffffe8ffffc00000-0xffffe8ffffe00000 2097152 pcpu_get_vm_areas+0x0/0x790 vmalloc vsftpd bug: <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED NOTABUG - vsftpd: Do not create network namespace per connection" href="show_bug.cgi?id=711134">https://bugzilla.redhat.com/show_bug.cgi?id=711134</a> Proposed patches (but has connection rates problem): <a href="http://patchwork.ozlabs.org/patch/88217/">http://patchwork.ozlabs.org/patch/88217/</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Linux kernel | <=2.6.32 | |
| Redhat Enterprise Linux | =6.0 | |
| Redhat Enterprise Mrg | =2.0 | |
| Canonical Ubuntu Linux | =10.10 | |
| Canonical Ubuntu Linux | =11.04 | |
| Canonical Ubuntu Linux | =11.10 | |
| Canonical Ubuntu Linux | =10.04 | |
| Debian Debian Linux | =5.0 | |
| Debian Debian Linux | =7.0 | |
| Debian Debian Linux | =6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.debian.org/security/2011/dsa-2305
- http://www.openwall.com/lists/oss-security/2011/06/06/20
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629373
- https://bugs.launchpad.net/ubuntu/+source/linux/+bug/720095
- http://kerneltrap.org/mailarchive/git-commits-head/2009/12/8/15289
- https://bugzilla.redhat.com/show_bug.cgi?id=711245
- http://www.openwall.com/lists/oss-security/2011/06/06/10
- https://bugzilla.redhat.com/show_bug.cgi?id=711134
- http://patchwork.ozlabs.org/patch/88217/
- http://ie.archive.ubuntu.com/linux/kernel/v2.6/ChangeLog-2.6.33
- http://www.ubuntu.com/usn/USN-1288-1
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f875bae065334907796da12523f9df85c89f5712
- http://neil.brown.name/git?p=linux-2.6%3Ba=patch%3Bh=2b035b39970740722598f7a9d548835f9bdd730f
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2b035b39970740722598f7a9d548835f9bdd730f
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=711134
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=749061
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=711134#c16
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/author
- agent/event
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-2189
- agent/tags
- agent/trending
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/2.6.32
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/6.0
- canonical/redhat enterprise mrg
- version/redhat enterprise mrg/2.0
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/10.10
- version/canonical ubuntu linux/11.04
- version/canonical ubuntu linux/11.10
- version/canonical ubuntu linux/10.04
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/5.0
- version/debian debian linux/7.0
- version/debian debian linux/6.0