linux-kernel - Re: Patch related with Fork Bombing Atack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200706010325.23185.dhazelton@enter.net>
Date:	Fri, 1 Jun 2007 03:25:22 -0400
From:	Daniel Hazelton <dhazelton@...er.net>
To:	"Anand Jahagirdar" <anandjigar@...il.com>
Cc:	"Jens Axboe" <jens.axboe@...cle.com>, security@...nel.org,
	linux-kernel@...r.kernel.org
Subject: Re: Patch related with Fork Bombing Atack

On Friday 01 June 2007 02:48:59 Anand Jahagirdar wrote:
> On 5/31/07, Jens Axboe <jens.axboe@...cle.com> wrote:
> > On Thu, May 31 2007, Anand Jahagirdar wrote:
> > > 2) Printk message in my patch will definitely help Administrator/Root
> > > User to detect which particular user is trying fork bombing attack on
> > > his machine by looking at /var/log/messages or dmesg . he can take
> > > action against that particular user and kill his processes.
> >
> > You just opened a DoS possibility for any user, they can now flood the
> > syslog instead.
>
> Jens Axboe
>
>      when they try to flood the syslog using fork bombing attack,
> their messge will be printed only once in syslog and it will show how
> many times it has repeated. due to this he will not able to flood the
> syslog.and i am using only one single variable in my printk messge so
> it is quite not possible to flood the syslog.
>
>    am i missing something??
>
> anand

Most definately. Each printk() call outputs to syslog - which means that every 
time your code outputs its message there is another line in the logs. It then 
becomes possible to use that to flood the syslog.

DRH

(I hate having to explain the obvious)
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/