Actu
Vigil@nce - Linux kernel: denial of service via argv
November 2010 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/
SYNTHESIS OF THE VULNERABILITY
A local attacker can create a program allocating a lot of memory
for parameters of another program, in order to create a denial of
service.
Severity: 1/4
Creation date: 22/11/2010
DESCRIPTION OF THE VULNERABILITY
The Linux kernel contains an OOM (Out Of Memory) Killer which
kills processes consuming a lot of memory, so a local attacker
cannot create a permanent denial of service.
Parameters of a program (named "argv" in the C language) are not
counted for the used memory size of a process. A local attacker
can therefore create programs with large parameters, in order to
bypass the OOM Killer.
A local attacker can therefore create a program allocating a lot
of memory for parameters of another program, in order to create a
denial of service.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Linux-kernel-denial-of-service-via-argv-10143
