lkml.org 
[lkml]   [2010]   [Aug]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH] exec argument expansion can inappropriately trigger OOM-killer
    Brad Spengler published a local memory-allocation DoS that
    evades the OOM-killer (though not the virtual memory RLIMIT):
    http://www.grsecurity.net/~spender/64bit_dos.c

    The recent changes to create a stack guard page helps slightly to
    discourage this attack, but it is not sufficient. Compiling it statically
    moves the libraries out of the way, allowing the stack VMA to fill the
    entire TASK_SIZE.

    There are two issues:
    1) the OOM killer doesn't notice this argv memory explosion
    2) the argv expansion does not check if rlim[RLIMIT_STACK].rlim_cur is -1.

    I figure a quick solution for #2 would be the following patch. However,
    running multiple copies of this program could result in similar OOM
    behavior, so issue #1 still needs a solution.

    Reported-by: Brad Spengler <spender@grsecurity.net>
    Signed-off-by: Kees Cook <kees.cook@canonical.com>
    ---
    fs/exec.c | 3 ++-
    1 files changed, 2 insertions(+), 1 deletions(-)

    diff --git a/fs/exec.c b/fs/exec.c
    index dab85ec..be40063 100644
    --- a/fs/exec.c
    +++ b/fs/exec.c
    @@ -194,7 +194,8 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
    * to work from.
    */
    rlim = current->signal->rlim;
    - if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4) {
    + if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4 ||
    + size > TASK_SIZE / 4) {
    put_page(page);
    return NULL;
    }
    --
    1.7.1
    --
    Kees Cook
    Ubuntu Security Team


    \
     
     \ /
      Last update: 2010-08-28 00:07    [W:0.023 / U:151.940 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site