CVE-2016-6213 in Linux
Summary
by MITRE
fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of mounts.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2022
The vulnerability identified as CVE-2016-6213 represents a critical design flaw in the Linux kernel's mount namespace implementation that existed prior to version 4.9. This issue stems from the absence of proper limits on the number of mounts that can exist within a single mount namespace, creating an exploitable condition that allows local attackers to consume excessive system resources and potentially cause system instability. The flaw is particularly dangerous because it can be triggered through legitimate system calls, making it difficult to distinguish from normal operational behavior.
The technical root cause of this vulnerability lies in the fs/namespace.c file where the kernel fails to enforce reasonable constraints on mount operations within namespaces. When attackers utilize the MS_BIND mount system call in a loop, they can create an exponential growth pattern in the number of mounts within a single namespace. This uncontrolled growth leads to memory exhaustion as each mount operation consumes kernel memory structures, eventually causing the system to become unresponsive or crash entirely. The vulnerability specifically exploits the lack of mount count limits that should normally prevent such resource exhaustion scenarios.
The operational impact of CVE-2016-6213 is severe and multifaceted, affecting system stability and availability through multiple vectors. Local users can leverage this vulnerability to cause both memory consumption and deadlock conditions that effectively render the system unusable. The exponential growth pattern of mounts means that even small sequences of malicious mount operations can quickly overwhelm system resources, making this a particularly effective denial of service attack. The vulnerability affects any Linux system running kernel versions before 4.9, representing a significant risk to production environments where local access is possible.
This vulnerability maps to CWE-770, which specifically addresses the allocation of resources without limits or with inadequate limits, and aligns with ATT&CK technique T1499.004 for resource exhaustion. The attack pattern follows a typical privilege escalation path where local users can leverage kernel-level functionality to cause system-wide disruption. From a security perspective, this represents a classic case of insufficient resource management that allows attackers to consume system resources beyond normal operational limits, effectively creating a denial of service condition that can be exploited without requiring elevated privileges beyond local access.
The recommended mitigation strategy involves upgrading to Linux kernel version 4.9 or later, where the kernel developers implemented proper limits on mount namespace growth. Additionally, system administrators should monitor mount namespace usage and implement process limits to prevent uncontrolled mount operations. The fix introduced in kernel 4.9 includes enforcement of mount limits that prevent the exponential growth pattern that enabled this vulnerability, effectively closing the attack vector while maintaining legitimate system functionality. Organizations should also consider implementing monitoring solutions that can detect unusual mount activity patterns that might indicate exploitation attempts.