Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 6 Aug 2013 18:47:45 +0200
From: Oleg Nesterov <>
        Petr Matousek <>
Cc: "Eric W. Biederman" <>,
        Andy Lutomirski <>
Subject: Re: CLONE_NEWUSER local DoS

On 08/06, Petr Matousek wrote:
> spender reported [1] a local DoS triggerable by unprivileged user when
> user namespaces are enabled (CONFIG_USER_NS).
>   [1]
> Reproducer:
> b836010000bb00000010cd80ebf2 is for(;;)unshare(1<<28);

What happens? OOM?

I'll recheck, but at first glance this is simple, unshare_userns()
populates new_cred which is not freed by bad_unshare_cleanup_fd
if create_user_ns() fails. And create_user_ns() _should_ fail (iiuc)
when CLONE_NEWUSER is called for the second time and later due to

I'll send the patch, but perhaps there is something else. Eric?


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.