Multiple Vendor Shared Memory Denial of Service Vulnerability
BID:526
Info
Multiple Vendor Shared Memory Denial of Service Vulnerability
| Bugtraq ID: | 526 |
| Class: | Design Error |
| CVE: |
CVE-1999-1518 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jul 15 1999 12:00AM |
| Updated: | Jul 11 2009 12:56AM |
| Credit: | First posted to BugTraq by Mike Perry <[email protected]> on July 15, 1999. |
| Vulnerable: |
NetBSD NetBSD 1.4 x86 NetBSD NetBSD 1.3.3 NetBSD NetBSD 1.3.2 NetBSD NetBSD 1.3.1 Linux kernel 2.3 Linux kernel 2.2 Linux kernel 2.1 Linux kernel 2.0.37 Linux kernel 2.0.34 Linux kernel 2.0.33 Linux kernel 2.0 FreeBSD FreeBSD 3.2 FreeBSD FreeBSD 3.1 FreeBSD FreeBSD 3.0 FreeBSD FreeBSD 2.2.8 FreeBSD FreeBSD 2.2.6 FreeBSD FreeBSD 2.2.5 FreeBSD FreeBSD 2.2.4 FreeBSD FreeBSD 2.2.3 FreeBSD FreeBSD 2.2.2 FreeBSD FreeBSD 2.1.7 .1 FreeBSD FreeBSD 2.1.6 FreeBSD FreeBSD 2.1.5 FreeBSD FreeBSD 2.1 FreeBSD FreeBSD 2.0.5 FreeBSD FreeBSD 2.0 FreeBSD FreeBSD 1.1.5 .1 BSDI BSD/OS 4.0 BSDI BSD/OS 3.0 BSDI BSD/OS 2.1 BSDI BSD/OS 2.0.1 BSDI BSD/OS 1.1 |
| Not Vulnerable: | |
Discussion
Multiple Vendor Shared Memory Denial of Service Vulnerability
Operating systems with a shared memory implementation based on or influenced by the 4.4BSD code may be vulnerable to a denial of service attack The problem exists because you can mmap() or shmget() as much memory as you'd like bypassing rlimits. When you trigger pagefaults, the system will begin allocating the memory (it's not actually allocated at first) and run out. With System V IPC the memory remains allocated even after the process has stopped running.
Operating systems with a shared memory implementation based on or influenced by the 4.4BSD code may be vulnerable to a denial of service attack The problem exists because you can mmap() or shmget() as much memory as you'd like bypassing rlimits. When you trigger pagefaults, the system will begin allocating the memory (it's not actually allocated at first) and run out. With System V IPC the memory remains allocated even after the process has stopped running.
Exploit / POC
Multiple Vendor Shared Memory Denial of Service Vulnerability
x
x
Solution / Fix
Multiple Vendor Shared Memory Denial of Service Vulnerability
Solution:
Mike Perry <[email protected]> provided a patch for the linux login binary for a related memory leak in his bugtraq posting. It is available in the message linked to in the credit section of this vulnerability entry.
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Mike Perry <[email protected]> provided a patch for the linux login binary for a related memory leak in his bugtraq posting. It is available in the message linked to in the credit section of this vulnerability entry.
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].