Linux Kernel Local MEMLOCK RLIMIT Bypass Denial Of Service Vulnerability

Bugtraq ID:	13769
Class:	Design Error
CVE:	CVE-2004-0491
Remote:	No
Local:	Yes
Published:	May 25 2005 12:00AM
Updated:	Jul 12 2009 02:56PM
Credit:	Discovery of this issue is credited to Mark J. Cox.
Vulnerable:	SGI ProPack 3.0 SP6 SGI ProPack 3.0 SP5 SGI ProPack 3.0 SP4 SGI ProPack 3.0 SP3 SGI ProPack 3.0 SP2 SGI ProPack 3.0 SP1 SGI ProPack 3.0 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux AS 3 Redhat Desktop 3.0 Linux kernel 2.4.21 + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 + Redhat Desktop 3.0 + Redhat Enterprise Linux AS 3 + Redhat Enterprise Linux ES 3 + Redhat Enterprise Linux WS 3 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + SuSE SUSE Linux Enterprise Server 8
Not Vulnerable:

Linux Kernel Local MEMLOCK RLIMIT Bypass Denial Of Service Vulnerability

The 'linux-2.4.21-mlock.patch' for the Linux kernel contains a security vulnerability. Reports indicate that the 'rlimit' restrictions do not correctly account for IPC (Inter-process Communications) functionality; this may result in unprivileged users having the right to 'mlock' memory.

A local attacker may exploit this issue to deny service for legitimate users.

Linux Kernel Local MEMLOCK RLIMIT Bypass Denial Of Service Vulnerability


Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Linux Kernel Local MEMLOCK RLIMIT Bypass Denial Of Service Vulnerability

Solution:
Please see the referenced vendor advisories for details on obtaining and applying fixes.

Linux Kernel Local MEMLOCK RLIMIT Bypass Denial Of Service Vulnerability

References:

• 20060402-01-U - SGI ProPack3 Kernel Update #21 - Security and other fixes (SGI)
  
• RHSA-2005:472-05 - kernel security update (RedHat)