CVE request: setrlimit can be avoided (Linux less than 2.6.22)

[Kees Cook <kees () outflux net>]

Hi,

This rlimit-avoiding bug probably needs a CVE associated with it.  Users
could avoid RLIMIT_CPU by setting it to "0".  The fixes in 2.6.17 did
not actually fix the problem.


Bugs:
  https://launchpad.net/bugs/107209
  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=419706

Fixed in 2.6.22:
  
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=9926e4c74300c4b31dee007298c6475d33369df0

Thanks,

-Kees

-- 
Kees Cook
Ubuntu Security Team