CVE-2012-4398: Input Validation
As Tetsuo Handa pointed out, requestmodule() can stress the system while the oom-killed caller sleeps in TASKUNINTERRUPTIBLE.
The task T uses "almost all" memory, then it does something which triggers requestmodule(). Say, it can simply call syssocket(). This in turn needs more memory and leads to OOM. oom-killer correctly chooses T and kills it, but this can't help because it sleeps in TASKUNINTERRUPTIBLE and after that oom-killer becomes "disabled" by the TIFMEMDIE task T.
A local unprivileged user can make the system unusable.
Upstream fixes: (1) 70834d30 "usermodehelper: use UMHWAITPROC consistently" (2) b3449922 "usermodehelper: introduce umhcomplete(subinfo)" (3) d0bd587a "usermodehelper: implement UMHKILLABLE" (4) 9d944ef3 "usermodehelper: kill umhwait, renumber UMH constants" (5) 5b9bd473 "usermodehelper: callusermodehelper() doesn't need doexit()" (6) 3e63a93b "kmod: introduce callmodprobe() helper" (7) 1cc684ab "kmod: make requestmodule() killable"
According to the reporter, (1) and (4) are optional and safer to exclude.
References: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/963685
Acknowledgements:
Red Hat would like to thank Tetsuo Handa for reporting this issue.
Other sources
The requestmodule function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain killable attribute, which allows local users to cause a denial of service (memory consumption) via a crafted application.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4398?
CVE-2012-4398 has a medium severity level as it can lead to system instability due to excessive memory use.
How do I fix CVE-2012-4398?
To fix CVE-2012-4398, upgrade your Linux kernel to version 5.10.223-1 or later, or any of the specified remedied versions.
Which Linux kernel versions are affected by CVE-2012-4398?
CVE-2012-4398 affects Linux kernel versions up to 3.4 and certain 3.0 release candidates.
What causes the vulnerability CVE-2012-4398?
CVE-2012-4398 is caused by the request_module() function stressing the system while a task is in a non-interruptible sleep state.
Is there a known exploit for CVE-2012-4398?
There are no widely reported exploits for CVE-2012-4398, but system administrators should still apply the necessary patches as a precaution.