Date: Wed, 2 Mar 2016 12:00:31 -0500 (EST) From: cve-assign@...re.org To: vdronov@...hat.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE request -- linux kernel: pipe: limit the per-user amount of pages allocated in pipes -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=759c01142a5d0f364a462346168a56de28a80f52 > The result is an OOM condition and oom-killer is not able to help > much, as the memory for the pipe data is a kernel memory and a memory > footprint of offensive processes is small. We feel that this should most likely have a CVE ID. The discussion outlines a realistic problem "it is possible for a single process to cause an OOM condition by filling large pipes with data that are never read. A typical process filling 4000 pipes with 1 MB of data will use 4 GB of memory" and the need for a CVE ID does not depend on the details of the solution approach. Also, there doesn't seem to be any general opposition to addressing the problem (e.g., see the https://lkml.org/lkml/2016/1/19/674 post). However, the commit indicates that there isn't a mandatory behavior change ("The limit are controlled by two new sysctls : pipe-user-pages-soft, and pipe-user-pages-hard. Both may be disabled by setting them to zero.") -- suggesting a possible interpretation as a design enhancement, not a vulnerability fix. Also, the discussion doesn't directly comment on whether the "filling large pipes" scenario has a security impact that is otherwise unavailable to the attacker, e.g., it doesn't discuss the difference between the attacker choosing to fill 4000 pipes and the attacker choosing to use mmap. Is there anyone who believes 759c01142a5d0f364a462346168a56de28a80f52 must not have a CVE ID? > The commit says: "Mitigates: CVE-2013-4312 (Linux 2.0+)" Regardless of any answers to the above question, it is not going to be useful to use CVE-2013-4312 to refer to 759c01142a5d0f364a462346168a56de28a80f52. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJW1xqUAAoJEL54rhJi8gl5sFcQAJjoPTO/xZL8sFOwfACRAXWD ycctDOyagiKIwnf9qyqSw18CTTskA2bRJTlhGywu3XnEKq/yAyYfj2+bNQ5OdvmT sQT+JTASckJIDnjqXefSxHZMbBTPOITyEZ52cZSRF8NvWyos1GUBxZRXE6Y1Nrx3 VF1pNDpbbjJtPpwQ81atxUInE9TDeG0o7BUcX5wP/Q4yIdjU1nZ2MdrYYK4Sn2H2 2/DECleX8EG8oUrPGxm64OXxmAOxB3E3Vigc0LC6OBindvU6VhjyeKzuKduu4W+m 6GkIllgEzkBGlwqXTmLvbeB+TpnHU3w6ZdnAynmJHwV+AmivFOPHsJhOXlrAKz7S KRIkAgeSHOjqK6rg3V3+/az33v9yzl3dQGEmZYs3d/bX94A2q8Z/ECNOfMHk0uH3 BbveT32coxxqOjAT4NrOVfWsQtiz2B2hSQek8URYYNuONKI/Qmc6Dk/lnTK5K4jO l3/tAqNM/avKbp6Q5rJ+JBZX/nH7x05bNx2klPVB1yZyBn6F+RbJYauQMerEcMUa ChSVYfUi7+k9ogqk/7/b8EhJiLK92CmBfsUFTIvuI+UUq0fQNMKGXvmYYJHHKOi/ DJcKAIid0FLbXXi1YsCrFJu2NrvS0UiKOUeF/D0rVdm3emYGTIWbQOkvuDAsUs7e 8mWQWhBXp+LU6fTUHdZi =pIDG -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.