lkml.org 
[lkml]   [2004]   [Sep]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [grsec] Linux 2.4.27 SECURITY BUG - TCP Local (probable Remote) Denial of Service
    Wolfpaw - Dale Corse wrote:

    >Greetings,
    >
    > My apologies if this is to the wrong place - it happens to be the
    >first kernel bug I have found (or what appears to be one), and I'm
    >not entirely sure how to properly inform the Linux community about
    >it.
    >
    >Anyway - on to the bug :)
    >==========================
    >Severity: HIGH
    >Title: KERNEL: TCP Local (probable remote) Denial of Service
    >Date: September 11, 2004
    >
    >

    Actually, it seems that the sockets that are not closing properly are
    the ones opened by your proof of concept code, *NOT* the server. The
    servers (mysql and Apache), close their sockets properly. I could verify
    this over a network. Locally, I got

    tcp 0 0 192.168.53.2:41440 192.168.53.1:3306
    TIME_WAIT
    tcp 0 0 192.168.53.2:41442 192.168.53.1:3306
    TIME_WAIT
    tcp 0 0 192.168.53.2:41443 192.168.53.1:3306
    TIME_WAIT
    tcp 0 0 192.168.53.2:41452 192.168.53.1:3306
    TIME_WAIT
    tcp 0 0 192.168.53.2:41468 192.168.53.1:80
    TIME_WAIT
    tcp 0 0 192.168.53.2:41441 192.168.53.1:80
    TIME_WAIT
    tcp 0 0 192.168.53.2:41447 192.168.53.1:80
    TIME_WAIT
    tcp 0 0 192.168.53.2:41444 192.168.53.1:80 TIME

    etc..

    But on the server, only 1 or two ESTABISHED entries, nothing more.

    I don't see much of a DOS, except maybe to DOS a localhost. And you can
    do that already.

    >The socket table looks like this while it is going on:
    >
    >http://www.ancients.org/LG.txt
    >(it is 29,000+ lines, so I didn't put it here)
    >
    >


    --
    Building your applications one byte at a time
    http://www.galacticasoftware.com


    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 14:06    [W:0.024 / U:60.336 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site