oss-sec mailing list archives

Re: CVE request: setrlimit can be avoided (Linux less than 2.6.22)

From: "Steven M. Christey" <coley () linus mitre org>
Date: Wed, 12 Mar 2008 12:16:20 -0400 (EDT)


On Tue, 11 Mar 2008, Kees Cook wrote:

This rlimit-avoiding bug probably needs a CVE associated with it.  Users
could avoid RLIMIT_CPU by setting it to "0".  The fixes in 2.6.17 did
not actually fix the problem.


Use CVE-2008-1294 - will be filled in later.

- Steve

Current thread:

CVE request: setrlimit can be avoided (Linux less than 2.6.22) Kees Cook (Mar 11)
- Re: CVE request: setrlimit can be avoided (Linux less than 2.6.22) Florian Weimer (Mar 12)
- Re: CVE request: setrlimit can be avoided (Linux less than 2.6.22) Steven M. Christey (Mar 12)