CVE-2016-6213
published 2016-12-28CVE-2016-6213: fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of…
PriorityP414medium4.7CVSS 3.0
AVLACHPRLUINSUCNINAH
EPSS
0.37%
29.9th percentile
fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of mounts.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.8.11-1 (bookworm) | linux 4.8.11-1 (bookworm) |
| linux | linux_kernel | <= 4.8.15 | — |
| linux | linux_kernel | >= 0 < 4.8.11-1 | 4.8.11-1 |
| linux | linux_kernel | >= 0 < 4.8.11-1 | 4.8.11-1 |
| linux | linux_kernel | >= 0 < 4.8.11-1 | 4.8.11-1 |
| linux | linux_kernel | >= 0 < 4.8.11-1 | 4.8.11-1 |
| linux | linux_kernel | >= 0 < 3.13.0-106.153 | 3.13.0-106.153 |
| linux | linux_kernel | >= 0 < 4.4.0-57.78 | 4.4.0-57.78 |
CVSS provenance
nvdv3.04.7MEDIUMCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.7MEDIUMAV:L/AC:M/Au:N/C:N/I:N/A:C
osv5.5MEDIUM
vendor_ubuntu5.5MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wwfp-4jrf-hfh5: fs/namespace
ghsa_unreviewed·2022-05-14
CVE-2016-6213 [MEDIUM] CWE-400 GHSA-wwfp-4jrf-hfh5: fs/namespace
fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of mounts.
OSV
CVE-2016-6213: fs/namespace
osv·2016-12-28·CVSS 4.7
CVE-2016-6213 [MEDIUM] CVE-2016-6213: fs/namespace
fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of mounts.
OSV
linux-snapdragon vulnerabilities
osv·2016-12-20·CVSS 5.5
CVE-2015-8964 [MEDIUM] linux-snapdragon vulnerabilities
linux-snapdragon vulnerabilities
Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the
TTY implementation in the Linux kernel. A local attacker could use this to
expose sensitive information (kernel memory). (CVE-2015-8964)
It was discovered that the Video For Linux Two (v4l2) implementation in the
Linux kernel did not properly handle multiple planes when processing a
VIDIOC_DQBUF ioctl(). A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2016-4568)
CAI Qian discovered that shared bind mounts in a mount namespace
exponentially added entries without restriction to the Linux kernel's mount
table. A local attacker could use this to cause a denial of service (system
crash). (CVE-2016-6213)
Andreas Grue
OSV
linux vulnerabilities
osv·2016-12-20·CVSS 4.7
CVE-2016-6213 [MEDIUM] linux vulnerabilities
linux vulnerabilities
CAI Qian discovered that shared bind mounts in a mount namespace
exponentially added entries without restriction to the Linux kernel's mount
table. A local attacker could use this to cause a denial of service (system
crash). (CVE-2016-6213)
It was discovered that a race condition existed in the procfs
environ_read function in the Linux kernel, leading to an integer
underflow. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2016-7916)
OSV
linux vulnerabilities
osv·2016-12-20·CVSS 5.5
CVE-2015-8964 [MEDIUM] linux vulnerabilities
linux vulnerabilities
Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the
TTY implementation in the Linux kernel. A local attacker could use this to
expose sensitive information (kernel memory). (CVE-2015-8964)
It was discovered that the Video For Linux Two (v4l2) implementation in the
Linux kernel did not properly handle multiple planes when processing a
VIDIOC_DQBUF ioctl(). A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2016-4568)
CAI Qian discovered that shared bind mounts in a mount namespace
exponentially added entries without restriction to the Linux kernel's mount
table. A local attacker could use this to cause a denial of service (system
crash). (CVE-2016-6213)
It was discovered that
OSV
linux-lts-xenial vulnerabilities
osv·2016-12-20·CVSS 5.5
CVE-2015-8964 [MEDIUM] linux-lts-xenial vulnerabilities
linux-lts-xenial vulnerabilities
USN-3161-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the
TTY implementation in the Linux kernel. A local attacker could use this to
expose sensitive information (kernel memory). (CVE-2015-8964)
It was discovered that the Video For Linux Two (v4l2) implementation in the
Linux kernel did not properly handle multiple planes when processing a
VIDIOC_DQBUF ioctl(). A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2016-4568)
CAI Qian discovered that shared bind mou
OSV
linux-raspi2 vulnerabilities
osv·2016-12-20·CVSS 5.5
CVE-2015-8964 [MEDIUM] linux-raspi2 vulnerabilities
linux-raspi2 vulnerabilities
Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the
TTY implementation in the Linux kernel. A local attacker could use this to
expose sensitive information (kernel memory). (CVE-2015-8964)
It was discovered that the Video For Linux Two (v4l2) implementation in the
Linux kernel did not properly handle multiple planes when processing a
VIDIOC_DQBUF ioctl(). A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2016-4568)
CAI Qian discovered that shared bind mounts in a mount namespace
exponentially added entries without restriction to the Linux kernel's mount
table. A local attacker could use this to cause a denial of service (system
crash). (CVE-2016-6213)
Ondrej Kozina di
Kernel
mnt: Make propagate_umount less slow for overlapping mount propagation trees
kernel_security·2016-10-24
CVE-2016-6213 mnt: Make propagate_umount less slow for overlapping mount propagation trees
mnt: Make propagate_umount less slow for overlapping mount propagation trees
Andrei Vagin pointed out that time to executue propagate_umount can go
non-linear (and take a ludicrious amount of time) when the mount
propogation trees of the mounts to be unmunted by a lazy unmount
overlap.
Make the walk of the mount propagation trees nearly linear by
remembering which mounts have already been visited, allowing
subsequent walks to detect when walking a mount propgation tree or a
subtree of a mount propgation tree would be duplicate work and to skip
them entirely.
Walk the list of mounts whose propgatation trees need to be traversed
from the mount highest in the mount tree to mounts lower in the mount
tree so that odds are higher that the code will walk the largest trees
first, allowing later
Kernel
mnt: Add a per mount namespace limit on the number of mounts
kernel_security·2016-09-28·CVSS 4.7
CVE-2016-6213 [MEDIUM] mnt: Add a per mount namespace limit on the number of mounts
mnt: Add a per mount namespace limit on the number of mounts
CAI Qian pointed out that the semantics
of shared subtrees make it possible to create an exponentially
increasing number of mounts in a mount namespace.
mkdir /tmp/1 /tmp/2
mount --make-rshared /
for i in $(seq 1 20) ; do mount --bind /tmp/1 /tmp/2 ; done
Will create create 2^20 or 1048576 mounts, which is a practical problem
as some people have managed to hit this by accident.
As such CVE-2016-6213 was assigned.
Ian Kent described the situation for autofs users
as follows:
> The number of mounts for direct mount maps is usually not very large because of
> the way they are implemented, large direct mount maps can have performance
> problems. There can be anywhere from a few (likely case a few hundred) to less
> than 10000,
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities
vendor_ubuntu·2016-12-20·CVSS 5.5
CVE-2015-8964 [MEDIUM] Linux kernel (Xenial HWE) vulnerabilities
Title: Linux kernel (Xenial HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
USN-3161-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the
TTY implementation in the Linux kernel. A local attacker could use this to
expose sensitive information (kernel memory). (CVE-2015-8964)
It was discovered that the Video For Linux Two (v4l2) implementation in the
Linux kernel did not properly handle multiple planes when processing a
VIDIOC_DQBUF ioctl(). A local attacker could use this to cause a denial of
service (system crash) or possibly execu
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-12-20·CVSS 5.5
CVE-2015-8964 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the
TTY implementation in the Linux kernel. A local attacker could use this to
expose sensitive information (kernel memory). (CVE-2015-8964)
It was discovered that the Video For Linux Two (v4l2) implementation in the
Linux kernel did not properly handle multiple planes when processing a
VIDIOC_DQBUF ioctl(). A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2016-4568)
CAI Qian discovered that shared bind mounts in a mount namespace
exponentially added entries without restriction to the Linux kernel's mount
table. A local attacker could use this to cause a
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-12-20·CVSS 4.7
CVE-2016-6213 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
CAI Qian discovered that shared bind mounts in a mount namespace
exponentially added entries without restriction to the Linux kernel's mount
table. A local attacker could use this to cause a denial of service (system
crash). (CVE-2016-6213)
It was discovered that a race condition existed in the procfs
environ_read function in the Linux kernel, leading to an integer
underflow. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2016-7916)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requ
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-12-20·CVSS 4.7
CVE-2016-9313 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
CAI Qian discovered that shared bind mounts in a mount namespace
exponentially added entries without restriction to the Linux kernel's mount
table. A local attacker could use this to cause a denial of service (system
crash). (CVE-2016-6213)
It was discovered that the KVM implementation for x86/x86_64 in the Linux
kernel could dereference a null pointer. An attacker in a guest virtual
machine could use this to cause a denial of service (system crash) in the
KVM host. (CVE-2016-8630)
Eyal Itkin discovered that the IP over IEEE 1394 (FireWire) implementation
in the Linux kernel contained a buffer overflow when handling fragmented
packets. A remote attacker could use this to possibly execute arbi
Ubuntu
Linux kernel (Raspberry Pi 2) vulnerabilities
vendor_ubuntu·2016-12-20·CVSS 5.5
CVE-2015-8964 [MEDIUM] Linux kernel (Raspberry Pi 2) vulnerabilities
Title: Linux kernel (Raspberry Pi 2) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the
TTY implementation in the Linux kernel. A local attacker could use this to
expose sensitive information (kernel memory). (CVE-2015-8964)
It was discovered that the Video For Linux Two (v4l2) implementation in the
Linux kernel did not properly handle multiple planes when processing a
VIDIOC_DQBUF ioctl(). A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2016-4568)
CAI Qian discovered that shared bind mounts in a mount namespace
exponentially added entries without restriction to the Linux kernel's mount
table. A local attacker could use
Ubuntu
Linux kernel (Qualcomm Snapdragon) vulnerabilities
vendor_ubuntu·2016-12-20·CVSS 5.5
CVE-2015-8964 [MEDIUM] Linux kernel (Qualcomm Snapdragon) vulnerabilities
Title: Linux kernel (Qualcomm Snapdragon) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the
TTY implementation in the Linux kernel. A local attacker could use this to
expose sensitive information (kernel memory). (CVE-2015-8964)
It was discovered that the Video For Linux Two (v4l2) implementation in the
Linux kernel did not properly handle multiple planes when processing a
VIDIOC_DQBUF ioctl(). A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2016-4568)
CAI Qian discovered that shared bind mounts in a mount namespace
exponentially added entries without restriction to the Linux kernel's mount
table. A local attacker coul
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2016-12-20·CVSS 4.7
CVE-2016-6213 [MEDIUM] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
USN-3160-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu
12.04 LTS.
CAI Qian discovered that shared bind mounts in a mount namespace
exponentially added entries without restriction to the Linux kernel's mount
table. A local attacker could use this to cause a denial of service (system
crash). (CVE-2016-6213)
It was discovered that a race condition existed in the procfs
environ_read function in the Linux kernel, leading to an integer
underflow. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2016-7916)
Ubuntu
Linux kernel (Raspberry Pi 2) vulnerabilities
vendor_ubuntu·2016-12-20·CVSS 4.7
CVE-2016-6213 [MEDIUM] Linux kernel (Raspberry Pi 2) vulnerabilities
Title: Linux kernel (Raspberry Pi 2) vulnerabilities
Summary: Several security issues were fixed in the kernel.
CAI Qian discovered that shared bind mounts in a mount namespace
exponentially added entries without restriction to the Linux kernel's mount
table. A local attacker could use this to cause a denial of service (system
crash). (CVE-2016-6213)
Andreas Gruenbacher and Jan Kara discovered that the filesystem
implementation in the Linux kernel did not clear the setgid bit during a
setxattr call. A local attacker could use this to possibly elevate group
privileges. (CVE-2016-7097)
Marco Grassi discovered that the driver for Areca RAID Controllers in the
Linux kernel did not properly validate control messages. A local attacker
could use this to cause a denial of service (system crash
Red Hat
kernel: Overflowing kernel mount table using shared bind mount
vendor_redhat·2016-07-13·CVSS 4.7
CVE-2016-6213 [MEDIUM] CWE-770 kernel: Overflowing kernel mount table using shared bind mount
kernel: Overflowing kernel mount table using shared bind mount
fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of mounts.
It was found that in Linux kernel the mount table expands by a power-of-two with each bind mount command. If a system is configured to allow non-privileged user to do bind mounts, or allows to do so in a container or unprivileged mount namespace, then non-privileged user is able to cause a local DoS by overflowing the mount table, which causes a deadlock for the whole system.
Statement: This issue does not affect t
Debian
CVE-2016-6213: linux - fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts ...
vendor_debian·2016·CVSS 4.7
CVE-2016-6213 [MEDIUM] CVE-2016-6213: linux - fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts ...
fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of mounts.
Scope: local
bookworm: resolved (fixed in 4.8.11-1)
bullseye: resolved (fixed in 4.8.11-1)
forky: resolved (fixed in 4.8.11-1)
sid: resolved (fixed in 4.8.11-1)
trixie: resolved (fixed in 4.8.11-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-6213 kernel: Overflowing kernel mount table using shared bind mount
bugzilla·2016-07-14·CVSS 4.7
CVE-2016-6213 [MEDIUM] CVE-2016-6213 kernel: Overflowing kernel mount table using shared bind mount
CVE-2016-6213 kernel: Overflowing kernel mount table using shared bind mount
It was found that in Linux kernel the mount table expands by a power-of-two with each bind mount command. If a system is configured to allow non-privileged user to do bind mounts, or allows to do so in a container or unprivileged mount namespace, then non-privileged user is able to cause a local DoS by overflowing the mount table, which causes a deadlock for the whole system.
CVE request:
http://seclists.org/oss-sec/2016/q3/56
Proofs:
http://seclists.org/oss-sec/2016/q3/65
http://seclists.org/oss-sec/2016/q3/75
Discussions:
https://lkml.org/lkml/2013/6/17/143
Discussion:
Acknowledgments:
Name: Qian Cai (Red Hat)
---
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1356472]
---
Bugzilla
CVE-2016-6213 kernel: Overflowing kernel mount table using shared bind mount [fedora-all]
bugzilla·2016-07-14·CVSS 4.7
CVE-2016-6213 [MEDIUM] CVE-2016-6213 kernel: Overflowing kernel mount table using shared bind mount [fedora-all]
CVE-2016-6213 kernel: Overflowing kernel mount table using shared bind mount [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported
Bugzilla
CVE-2016-6213 kernel: user namespace: unlimited consumed of kernel mount resources [rhel-7.4]
bugzilla·2016-03-30·CVSS 4.7
CVE-2016-6213 [MEDIUM] CVE-2016-6213 kernel: user namespace: unlimited consumed of kernel mount resources [rhel-7.4]
CVE-2016-6213 kernel: user namespace: unlimited consumed of kernel mount resources [rhel-7.4]
Description of problem:
Nested bind mount started to trigger kernel soft-lockup and eventually deadlock starting from 20 instances during either mount or umount.
# for i in `seq 1 20`; do mount -o bind /root/ /mnt/; done
# for i in `seq 1 20`; do umount /mnt/; done
[ 361.301885] NMI backtrace for cpu 0
[ 361.302352] CPU: 0 PID: 29 Comm: kworker/0:1 Not tainted 3.10.0-327.10.1.el7.x86_64 #1
[ 361.303062] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014
[ 361.303882] Workqueue: events qxl_fb_work [qxl]
[ 361.304379] task: ffff88013943d080 ti: ffff8801395ec000 task.ti: ffff8801395ec000
[ 361.305057] RIP: 0010:[] [] prune_super+0x23/0x170
[ 361.305784] R
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d29216842a85c7970c536108e093963f02714498http://www.openwall.com/lists/oss-security/2016/07/13/8http://www.securityfocus.com/bid/91754https://access.redhat.com/errata/RHSA-2017:1842https://access.redhat.com/errata/RHSA-2017:2077https://bugzilla.redhat.com/show_bug.cgi?id=1356471https://github.com/torvalds/linux/commit/d29216842a85c7970c536108e093963f02714498http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d29216842a85c7970c536108e093963f02714498http://www.openwall.com/lists/oss-security/2016/07/13/8http://www.securityfocus.com/bid/91754https://access.redhat.com/errata/RHSA-2017:1842https://access.redhat.com/errata/RHSA-2017:2077https://bugzilla.redhat.com/show_bug.cgi?id=1356471https://github.com/torvalds/linux/commit/d29216842a85c7970c536108e093963f02714498
2016-12-28
Published