Tested with https://github.com/dinosn/memcached-
security-2026/blob/master/poc/crawler-F-R2-01/poc_crawler.py

5 times each for noble stock, patched, resolute stock, patched.
stock had issue but patched don't. please refer to the result below.

Noble stock 4/5 failure, patched 0/5 
Resolute stock 1/5 failure, patched 0/5

// Noble stock

$ dpkg-query -W memcached
memcached       1.6.24-1build3

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 1211
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.24
populated slab-class item lines: ['STAT items:7:number 4000'] 
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ kill -0 "$memcached_pid"
bash: kill: (1211) - No such process
[1]+  Segmentation fault      (core dumped) /usr/bin/memcached -p 11212 -U 0 -l 
127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1
$ echo $?
1
$ kill "$memcached_pid"
bash: kill: (1211) - No such process
$ wait "$memcached_pid"

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 1228
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.24
populated slab-class item lines: ['STAT items:7:number 4000'] 
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
[1]+  Aborted                 (core dumped) /usr/bin/memcached -p 11212 -U 0 -l 
127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1
$ wait "$memcached_pid"
$ echo $?
134

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 1243
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.24
populated slab-class item lines: ['STAT items:7:number 4000'] 
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ jobs -l
[1]+  1243 Segmentation fault      (core dumped) /usr/bin/memcached -p 11212 -U 
0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1
$ wait "$memcached_pid"
$ echo $?
139

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 1263
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.24
populated slab-class item lines: ['STAT items:7:number 4000'] 
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ jobs -l
[1]+  1263 Segmentation fault      (core dumped) /usr/bin/memcached -p 11212 -U 
0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1
$ wait "$memcached_pid"
$ echo $?
139

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 1278
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.24
populated slab-class item lines: ['STAT items:7:number 4000'] 
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ jobs -l
[1]+  1278 Running                 /usr/bin/memcached -p 11212 -U 0 -l 
127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 &
$ kill -0 "$memcached_pid"
$ echo $?
0
$ kill "$memcached_pid"
$ wait "$memcached_pid"
[1]+  Done                    /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 
256 -u nobody > /tmp/memcached-poc.log 2>&1

// Noble patched

$ dpkg-query -W memcached
memcached       1.6.24-1ubuntu0.2~ppa1

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 8093
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.24
populated slab-class item lines: ['STAT items:7:number 4000'] 
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ jobs -l
[1]+  8093 Running                 /usr/bin/memcached -p 11212 -U 0 -l 
127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 &
$ kill -0 "$memcached_pid"
$ echo $?
0
$ kill "$memcached_pid"
$ wait "$memcached_pid"
[1]+  Done                    /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 
256 -u nobody > /tmp/memcached-poc.log 2>&1

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 8106
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.24
populated slab-class item lines: ['STAT items:7:number 4000'] 
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ jobs -l
[1]+  8106 Running                 /usr/bin/memcached -p 11212 -U 0 -l 
127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 &
$ kill -0 "$memcached_pid"
$ echo $?
0
$ kill "$memcached_pid"
$ wait "$memcached_pid"
[1]+  Done                    /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 
256 -u nobody > /tmp/memcached-poc.log 2>&1

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 8118
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.24
populated slab-class item lines: ['STAT items:7:number 4000'] 
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ jobs -l
[1]+  8118 Running                 /usr/bin/memcached -p 11212 -U 0 -l 
127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 &
$ kill -0 "$memcached_pid"
$ echo $?
0
$ kill "$memcached_pid"
$ wait "$memcached_pid"
[1]+  Done                    /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 
256 -u nobody > /tmp/memcached-poc.log 2>&1

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 8133
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.24
populated slab-class item lines: ['STAT items:7:number 4000'] 
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ jobs -l
[1]+  8133 Running                 /usr/bin/memcached -p 11212 -U 0 -l 
127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 &
$ kill -0 "$memcached_pid"
$ echo $?
0
$ kill "$memcached_pid"
$ wait "$memcached_pid"
[1]+  Done                    /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 
256 -u nobody > /tmp/memcached-poc.log 2>&1

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 8145
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.24
populated slab-class item lines: ['STAT items:7:number 4000'] 
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ jobs -l
[1]+  8145 Running                 /usr/bin/memcached -p 11212 -U 0 -l 
127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 &
$ kill -0 "$memcached_pid"
$ echo $?
0
$ kill "$memcached_pid"
$ wait "$memcached_pid"
[1]+  Done                    /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 
256 -u nobody > /tmp/memcached-poc.log 2>&1

// Resolute stock

$ dpkg-query -W memcached
memcached       1.6.40-1
$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 1189
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.40
populated slab-class item lines: ['STAT items:7:number 4000']
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ kill -0 "$memcached_pid"
$ echo $?
0
$ kill "$memcached_pid"
$ wait "$memcached_pid"
[1]+  Done                       /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 
-m 256 -u nobody > /tmp/memcached-poc.log 2>&1

// Resolute stock 5 times

$ dpkg-query -W memcached
memcached       1.6.40-1

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 1216
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.40
populated slab-class item lines: ['STAT items:7:number 4000']
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ kill -0 "$memcached_pid"
$ echo $?
0
$ kill "$memcached_pid"
$ wait "$memcached_pid"
[1]+  Done                       /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 
-m 256 -u nobody > /tmp/memcached-poc.log 2>&1

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 1233
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.40
populated slab-class item lines: ['STAT items:7:number 4000']
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ kill -0 "$memcached_pid"
$ echo $?
0
$ kill "$memcached_pid"
$ wait "$memcached_pid"
[1]+  Done                       /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 
-m 256 -u nobody > /tmp/memcached-poc.log 2>&1

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 1245
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.40
populated slab-class item lines: ['STAT items:7:number 4000']
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ kill -0 "$memcached_pid"
$ echo $?
0
$ kill "$memcached_pid"
$ wait "$memcached_pid"
[1]+  Done                       /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 
-m 256 -u nobody > /tmp/memcached-poc.log 2>&1

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 1258
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.40
populated slab-class item lines: ['STAT items:7:number 4000']
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
[1]+  Segmentation fault         (core dumped) /usr/bin/memcached -p 11212 -U 0 
-l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1
$ wait "$memcached_pid"
$ echo $?
139

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 1280
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.40
populated slab-class item lines: ['STAT items:7:number 4000']
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ kill -0 "$memcached_pid"
$ echo $?
0
$ kill "$memcached_pid"
$ wait "$memcached_pid"
[1]+  Done                       /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 
-m 256 -u nobody > /tmp/memcached-poc.log 2>&1

// Resolute patched 5 times

$ lxc exec mc-human-resolute -- env PS1='$ ' bash --noprofile --norc -i
$ dpkg-query -W memcached
memcached       1.6.40-1ubuntu0.2~ppa1

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 7505
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.40
populated slab-class item lines: ['STAT items:7:number 4000'] 
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ kill -0 "$memcached_pid"
$ echo $?
0
$ kill "$memcached_pid"
$ wait "$memcached_pid"
[1]+  Done                       /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 
-m 256 -u nobody > /tmp/memcached-poc.log 2>&1

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 7519
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.40
populated slab-class item lines: ['STAT items:7:number 4000'] 
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ kill -0 "$memcached_pid"
$ echo $?
0
$ kill "$memcached_pid"
$ wait "$memcached_pid"
[1]+  Done                       /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 
-m 256 -u nobody > /tmp/memcached-poc.log 2>&1

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 7535
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.40
populated slab-class item lines: ['STAT items:7:number 4000'] 
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ kill -0 "$memcached_pid"
$ echo $?
0
$ kill "$memcached_pid"
$ wait "$memcached_pid"
[1]+  Done                       /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 
-m 256 -u nobody > /tmp/memcached-poc.log 2>&1

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 7547
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.40
populated slab-class item lines: ['STAT items:7:number 4000'] 
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ kill -0 "$memcached_pid"
$ echo $?
0
$ kill "$memcached_pid"
$ wait "$memcached_pid"
[1]+  Done                       /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 
-m 256 -u nobody > /tmp/memcached-poc.log 2>&1

$ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody 
>/tmp/memcached-poc.log 2>&1 &
[1] 7564
$ memcached_pid=$!
$ sleep 1
$ python3 /root/poc_crawler.py 11212
version resp: VERSION 1.6.40
populated slab-class item lines: ['STAT items:7:number 4000'] 
metadump requested; holding socket WITHOUT reading to force poll() timeouts...
done sleeping
$ kill -0 "$memcached_pid"
$ echo $?
0
$ kill "$memcached_pid"
$ wait "$memcached_pid"
[1]+  Done                       /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 
-m 256 -u nobody > /tmp/memcached-poc.log 2>&1

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2161693

Title:
  memcached: heap buffer overflow in LRU crawler dump (lru_crawler
  metadump) on an idle client

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/memcached/+bug/2161693/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to