CVE-2011-2484: Medium severity linux kernel vulnerability
Currently a single process may register exit handlers unlimited times. It may lead to a bloated listeners chain and very slow process terminations. E.g. after 10KK sent TASKSTATSCMDATTRREGISTERCPUMASKs ~300 Mb of kernel memory is stolen for the handlers chain and "time id" shows 2-7 seconds instead of normal 0.003. It makes it possible to exhaust all kernel memory and to eat much of CPU time by triggerring numerous exits on a single CPU ie it makes it possible for unprivileged user eat kernel memory and CPU without triggering OOM killer.
Introduced in f9fd8914c1acca0d98b69d831b128d5b52f03c51.
References: http://seclists.org/oss-sec/2011/q2/664 http://lists.openwall.net/linux-kernel/2011/06/16/605
Acknowledgements:
Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.
Other sources
The adddellistener function in kernel/taskstats.c in the Linux kernel 2.6.39.1 and earlier does not prevent multiple registrations of exit handlers, which allows local users to cause a denial of service (memory and CPU consumption), and bypass the OOM Killer, via a crafted application.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2484?
CVE-2011-2484 has a moderate severity as it affects the performance of the Linux kernel due to a possible memory bloat.
How do I fix CVE-2011-2484?
To fix CVE-2011-2484, increase the limitations on the number of exit handlers that can be registered in the Linux kernel.
Which versions of Linux are affected by CVE-2011-2484?
CVE-2011-2484 affects Linux Kernel versions up to and including 2.6.39.1.
What are the implications of CVE-2011-2484?
The implications of CVE-2011-2484 include slow process terminations and excessive memory consumption by the listeners chain.
Who is primarily affected by CVE-2011-2484?
Primarily, users running vulnerable versions of the Linux kernel in environments with high TASKSTATS_CMD_ATTR_REGISTER_CPUMASK usage are affected by CVE-2011-2484.