Linux Patches Aim To Provide Fork'ing Brute Force Attack Mitigation

Building off a set of "request for comments" patches from September, a set of patches were sent out on Sunday for providing brute force attack mitigation around the fork system call.

With attacks aiming to break Address Space Layout Randomization (ASLR) and similar attacks often relying on the fork system call in order to keep replicating the memory contents of the parent process, these patches aim to detect the behavior where fork is being exploited for these nefarious purposes.

This work is inspired in part by some patches carried by GrSecurity where a delay around the fork system call will be imposed if a child died from a fatal error. These patches propose collecting statistical data shared across all the processes with the same memory contents and analyzing the timing of any children processes crashing. When the code determines such an exploit may be underway leveraging fork, all of the processes using the same memory contents are killed to stop whatever malicious activity may be happening.

The proposed patches spin this fork brute force attack detection and mitigation as a Kconfig build option. The behavior can also be controlled on a per-process basis using prctl. The thresholds around the detection are configurable via sysfs.

Should this new security measure be of interest to you, these initial patches after the prior RFC series can be found on the kernel mailing list for review and discussion.