oss-sec mailing list archives
CVE request: setrlimit can be avoided (Linux less than 2.6.22)
From: Kees Cook <kees () outflux net>
Date: Tue, 11 Mar 2008 16:14:12 -0700
Hi, This rlimit-avoiding bug probably needs a CVE associated with it. Users could avoid RLIMIT_CPU by setting it to "0". The fixes in 2.6.17 did not actually fix the problem. Bugs: https://launchpad.net/bugs/107209 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=419706 Fixed in 2.6.22: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=9926e4c74300c4b31dee007298c6475d33369df0 Thanks, -Kees -- Kees Cook Ubuntu Security Team
Current thread:
- CVE request: setrlimit can be avoided (Linux less than 2.6.22) Kees Cook (Mar 11)
- Re: CVE request: setrlimit can be avoided (Linux less than 2.6.22) Florian Weimer (Mar 12)
- Re: CVE request: setrlimit can be avoided (Linux less than 2.6.22) Steven M. Christey (Mar 12)