blob: 884b1fac0c8ff16bf4d4dd65f6fea4ae7fd33f50 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
|
Candidate: CVE-2008-1294
Description:
Linux kernel 2.6.17, and other versions before 2.6.22, does not check
when a user attempts to set RLIMIT_CPU to 0 until after the change is
made, which allows local users to bypass intended resource limits.
References:
Ubuntu-Description:
It was discovered that CPU resource limits could be bypassed.
A malicious local user could exploit this to avoid administratively
imposed resource limits.
Notes:
https://launchpad.net/bugs/107209
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=419706
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=9926e4c74300c4b31dee007298c6475d33369df0
kees> for pre-2.6.17 kernels, two additional commits are needed:
kees> ec9e16bacdba1da1ee15dd162384e22df5c87e09
kees> e0661111e5441995f7a69dc4336c9f131cb9bc58
Bugs:
upstream:
linux-2.6:
2.6.18-etch-security: released (2.6.18.dfsg.1-18etch2) [bugfix/RLIMIT_CPU-earlier-checking.patch]
2.6.24-etch-security: N/A
2.6.15-dapper-security: released (2.6.15-52.67)
2.6.17-edgy-security: ignored (EOL)
2.6.20-feisty-security: released (2.6.20-17.36)
2.6.22-gutsy-security: N/A
2.6.24-hardy-security: N/A
|
