Tested with https://github.com/dinosn/memcached- security-2026/blob/master/poc/crawler-F-R2-01/poc_crawler.py
5 times each for noble stock, patched, resolute stock, patched. stock had issue but patched don't. please refer to the result below. Noble stock 4/5 failure, patched 0/5 Resolute stock 1/5 failure, patched 0/5 // Noble stock $ dpkg-query -W memcached memcached 1.6.24-1build3 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 1211 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.24 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ kill -0 "$memcached_pid" bash: kill: (1211) - No such process [1]+ Segmentation fault (core dumped) /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 $ echo $? 1 $ kill "$memcached_pid" bash: kill: (1211) - No such process $ wait "$memcached_pid" $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 1228 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.24 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping [1]+ Aborted (core dumped) /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 $ wait "$memcached_pid" $ echo $? 134 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 1243 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.24 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ jobs -l [1]+ 1243 Segmentation fault (core dumped) /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 $ wait "$memcached_pid" $ echo $? 139 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 1263 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.24 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ jobs -l [1]+ 1263 Segmentation fault (core dumped) /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 $ wait "$memcached_pid" $ echo $? 139 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 1278 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.24 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ jobs -l [1]+ 1278 Running /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 & $ kill -0 "$memcached_pid" $ echo $? 0 $ kill "$memcached_pid" $ wait "$memcached_pid" [1]+ Done /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 // Noble patched $ dpkg-query -W memcached memcached 1.6.24-1ubuntu0.2~ppa1 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 8093 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.24 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ jobs -l [1]+ 8093 Running /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 & $ kill -0 "$memcached_pid" $ echo $? 0 $ kill "$memcached_pid" $ wait "$memcached_pid" [1]+ Done /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 8106 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.24 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ jobs -l [1]+ 8106 Running /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 & $ kill -0 "$memcached_pid" $ echo $? 0 $ kill "$memcached_pid" $ wait "$memcached_pid" [1]+ Done /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 8118 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.24 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ jobs -l [1]+ 8118 Running /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 & $ kill -0 "$memcached_pid" $ echo $? 0 $ kill "$memcached_pid" $ wait "$memcached_pid" [1]+ Done /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 8133 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.24 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ jobs -l [1]+ 8133 Running /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 & $ kill -0 "$memcached_pid" $ echo $? 0 $ kill "$memcached_pid" $ wait "$memcached_pid" [1]+ Done /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 8145 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.24 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ jobs -l [1]+ 8145 Running /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 & $ kill -0 "$memcached_pid" $ echo $? 0 $ kill "$memcached_pid" $ wait "$memcached_pid" [1]+ Done /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 // Resolute stock $ dpkg-query -W memcached memcached 1.6.40-1 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 1189 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.40 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ kill -0 "$memcached_pid" $ echo $? 0 $ kill "$memcached_pid" $ wait "$memcached_pid" [1]+ Done /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 // Resolute stock 5 times $ dpkg-query -W memcached memcached 1.6.40-1 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 1216 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.40 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ kill -0 "$memcached_pid" $ echo $? 0 $ kill "$memcached_pid" $ wait "$memcached_pid" [1]+ Done /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 1233 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.40 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ kill -0 "$memcached_pid" $ echo $? 0 $ kill "$memcached_pid" $ wait "$memcached_pid" [1]+ Done /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 1245 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.40 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ kill -0 "$memcached_pid" $ echo $? 0 $ kill "$memcached_pid" $ wait "$memcached_pid" [1]+ Done /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 1258 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.40 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping [1]+ Segmentation fault (core dumped) /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 $ wait "$memcached_pid" $ echo $? 139 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 1280 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.40 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ kill -0 "$memcached_pid" $ echo $? 0 $ kill "$memcached_pid" $ wait "$memcached_pid" [1]+ Done /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 // Resolute patched 5 times $ lxc exec mc-human-resolute -- env PS1='$ ' bash --noprofile --norc -i $ dpkg-query -W memcached memcached 1.6.40-1ubuntu0.2~ppa1 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 7505 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.40 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ kill -0 "$memcached_pid" $ echo $? 0 $ kill "$memcached_pid" $ wait "$memcached_pid" [1]+ Done /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 7519 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.40 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ kill -0 "$memcached_pid" $ echo $? 0 $ kill "$memcached_pid" $ wait "$memcached_pid" [1]+ Done /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 7535 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.40 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ kill -0 "$memcached_pid" $ echo $? 0 $ kill "$memcached_pid" $ wait "$memcached_pid" [1]+ Done /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 7547 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.40 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ kill -0 "$memcached_pid" $ echo $? 0 $ kill "$memcached_pid" $ wait "$memcached_pid" [1]+ Done /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 $ /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody >/tmp/memcached-poc.log 2>&1 & [1] 7564 $ memcached_pid=$! $ sleep 1 $ python3 /root/poc_crawler.py 11212 version resp: VERSION 1.6.40 populated slab-class item lines: ['STAT items:7:number 4000'] metadump requested; holding socket WITHOUT reading to force poll() timeouts... done sleeping $ kill -0 "$memcached_pid" $ echo $? 0 $ kill "$memcached_pid" $ wait "$memcached_pid" [1]+ Done /usr/bin/memcached -p 11212 -U 0 -l 127.0.0.1 -m 256 -u nobody > /tmp/memcached-poc.log 2>&1 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2161693 Title: memcached: heap buffer overflow in LRU crawler dump (lru_crawler metadump) on an idle client To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/memcached/+bug/2161693/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
