CVE-2011-2189: canonical ubuntu_linux Uncontrolled Resource Consumption

CVSS: 7.8v2.0HighModified

AliasesDEBIAN-CVE-2011-2189

Published 10-10-2011Last modified 06-08-2024

Vulnerability summary

CVE-2011-2189 is a high (CVSS 7.8) Uncontrolled Resource Consumption vulnerability in canonical ubuntu_linux. EPSS estimates a 17.85% chance of exploitation in the next 30 days, higher than 97.1% of scored vulnerabilities. 5 public exploits are recorded.

Overall risk

45/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.8/10

010

High · v2.0 (NVD)

EPSS score

17.85%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits5reference, exploit-database

Timeline

10-10-2011
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

net/core/net_namespace.c in the Linux kernel 2.6.32 and earlier does not properly handle a high rate of creation and cleanup of network namespaces, which makes it easier for remote attackers to cause a denial of service (memory consumption) via requests to a daemon that requires a separate namespace per connection, as demonstrated by vsftpd.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.17.5v2.07.8

EPSS trend

Probability

17.85%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

0.00 pp

From 17.85% on 21-09-2026

21-09-202621-10-2026

EPSS score

17.85%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

5 found

referenceUnverified
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown
referenceUnverified
Exploit Reference (bugs.launchpad.net)
Maturity: unknown
referenceUnverified
Exploit Reference (bugs.debian.org)
Maturity: unknown

Show all 5 exploits

referenceUnverified
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown
exploit-databasedoslinuxVerified
Linux Kernel 2.6.35 - Network Namespace Remote Denial of Service
Maturity: poc

Weaknesses

CWE · root cause

CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.

Affected systems

Debian2 products

vsftpd< 2.3.4-1
debian_linuxEOL5.0 | 6.0 | 7.0

Redhat2 products

enterprise_linuxEOL6.0
enterprise_mrg2.0

Canonical1 product

ubuntu_linuxEOL10.04 | 10.10 | 11.04 | 11.10

Linux1 product

linux_kernel≤ 2.6.32

4 vendors · 6 products

References

15 links

bugzilla.redhat.com/show_bug.cgi?id=711245X Refsource CONFIRMExploitIssue TrackingPatchThird Party Advisory
bugs.launchpad.net/ubuntu/+source/linux/+bug/720095X Refsource CONFIRMExploitThird Party Advisory
neil.brown.name/git?p=linux-2.6%3Ba=patch%3Bh=2b035b39970740722598f7a9d548835f9bdd730fX Refsource CONFIRM
www.openwall.com/lists/oss-security/2011/06/06/20Mailing ListX Refsource MLISTThird Party Advisory
www.openwall.com/lists/oss-security/2011/06/06/10Mailing ListX Refsource MLISTThird Party Advisory
ie.archive.ubuntu.com/linux/kernel/v2.6/ChangeLog-2.6.33X Refsource CONFIRMBroken Link
www.debian.org/security/2011/dsa-2305Vendor AdvisoryX Refsource DEBIANThird Party Advisory
patchwork.ozlabs.org/patch/88217/X Refsource CONFIRMMailing ListPatchThird Party Advisory
kerneltrap.org/mailarchive/git-commits-head/2009/12/8/15289Mailing ListX Refsource MLISTBroken Link
bugs.debian.org/cgi-bin/bugreport.cgi?bug=629373X Refsource CONFIRMExploitMailing ListThird Party Advisory

Show all 15 references

www.ubuntu.com/usn/USN-1288-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
git.kernel.orgX Refsource CONFIRM
git.kernel.orgX Refsource CONFIRM
bugzilla.redhat.com/show_bug.cgi?id=711134X Refsource CONFIRMExploitIssue TrackingThird Party Advisory
security-tracker.debian.org/tracker/CVE-2011-2189Advisory

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities