Fork Brute Force Attack Detection/Mitigation Still Being Worked On For The Linux Kernel

[phoronix]

Phoronix: Fork Brute Force Attack Detection/Mitigation Still Being Worked On For The Linux Kernel

A security module continues to be worked on for being able to detect and mitigate against fork/execute brute force attacks to Linux systems...

https://www.phoronix.com/scan.php?page=news_item&px=Linux-v7-Brute-Force-Mitigation

[macemoneta]

I thought this was solved (many) years ago with ulimit? I remember testing fork bombs, and while they kept running, they were limited to a maximum number of processes that the system could deal with.

[archkde]

I thought this was solved (many) years ago with ulimit? I remember testing fork bombs, and while they kept running, they were limited to a maximum number of processes that the system could deal with.

ulimit only limits the number of descendant processes that run in parallel. The attacks mentioned in the article do not require a large number of parallel processes, as they can wait for the previous copy being killed before trying again.

That said, I don't really see what these attacks give you that you can't do by catching SIGSEGV.

[djf_]

I kinda wish it was called a "brute forks" attack...