oss-security - CVE request: setrlimit can be avoided (Linux less than 2.6.22)

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / community lists wiki CVSweb mirrors signatures
bringing security into open environments

Order Openwall GNU/*/Linux 2.0 on a CD with delivery worldwide

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Tue, 11 Mar 2008 16:14:12 -0700
From: Kees Cook <kees@...flux.net>
To: oss-security@...ts.openwall.com
Subject: CVE request: setrlimit can be avoided (Linux less than 2.6.22)

Hi,

This rlimit-avoiding bug probably needs a CVE associated with it.  Users
could avoid RLIMIT_CPU by setting it to "0".  The fixes in 2.6.17 did
not actually fix the problem.


Bugs:
  https://launchpad.net/bugs/107209
  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=419706

Fixed in 2.6.22:
  http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=9926e4c74300c4b31dee007298c6475d33369df0

Thanks,

-Kees

-- 
Kees Cook
Ubuntu Security Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.