oss-security - Re: CVE request: setrlimit can be avoided (Linux less than 2.6.22)

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 12 Mar 2008 13:13:16 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: setrlimit can be avoided (Linux less than 2.6.22)

* Kees Cook:

> This rlimit-avoiding bug probably needs a CVE associated with it.  Users
> could avoid RLIMIT_CPU by setting it to "0".  The fixes in 2.6.17 did
> not actually fix the problem.
>
>
> Bugs:
>   https://launchpad.net/bugs/107209
>   http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=419706
>
> Fixed in 2.6.22:
>   http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=9926e4c74300c4b31dee007298c6475d33369df0

I doubt it's fixed completely.  I've seen spinning Java processes on
later kernel versions which drove up the load average, but were reported
as 0% CPU most of the time.

Or does RLIMIT_CPU use separate counters?

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.