FreeBSD vfs_cache Denial of Service Vulnerability

Bugtraq ID:	653
Class:	Unknown
CVE:
Remote:	Yes
Local:	Yes
Published:	Sep 22 1999 12:00AM
Updated:	Sep 22 1999 12:00AM
Credit:	This vulnerability was found by Charles M. Hannum <[email protected]>.
Vulnerable:	FreeBSD FreeBSD 3.2 FreeBSD FreeBSD 3.1 FreeBSD FreeBSD 3.0
Not Vulnerable:	OpenBSD OpenBSD 2.5 NetBSD NetBSD 1.4.1 x86 NetBSD NetBSD 1.4 x86 Linux kernel 2.0 FreeBSD FreeBSD 3.3 FreeBSD FreeBSD 2.2.8

FreeBSD vfs_cache Denial of Service Vulnerability

A vulnerability exists in FreeBSD's new VFS cache introduced in version 3.0 that allows a local and possibly remote user to force the kernel to consume large quantities of wired memory thus creating a denial of service condition. The new VFS cache has no way to purge entries from memory while the file is open, consuming wired memory and allowing for the denial of service (memory that cannot be swapped out).

FreeBSD versions earlier than 3.0 are not vulnerable, nor is the original 4.4BSD-Lite code.

FreeBSD vfs_cache Denial of Service Vulnerability

An exploit has been made available.

• /data/vulnerabilities/exploits/vfs_cache.c

FreeBSD vfs_cache Denial of Service Vulnerability

Solution:
This vulnerability was fixed in src/sys/kern/vfs_cache.c version 1.38.2.3 by limiting the number of aliases to a vnode in the namecache to a sysctl tunable parameter ('vfs.cache.maxaliases': default 4).

Upgrade to the latest version of FreeBSD 3.3-STABLE to fix the problem.

FreeBSD vfs_cache Denial of Service Vulnerability

References: