Linux Patches Aim To Provide Fork'ing Brute Force Attack Mitigation

Written by Michael Larabel in Linux Security on 26 October 2020 at 12:20 AM EDT. 8 Comments
LINUX SECURITY
Building off a set of "request for comments" patches from September, a set of patches were sent out on Sunday for providing brute force attack mitigation around the fork system call.

With attacks aiming to break Address Space Layout Randomization (ASLR) and similar attacks often relying on the fork system call in order to keep replicating the memory contents of the parent process, these patches aim to detect the behavior where fork is being exploited for these nefarious purposes.

This work is inspired in part by some patches carried by GrSecurity where a delay around the fork system call will be imposed if a child died from a fatal error. These patches propose collecting statistical data shared across all the processes with the same memory contents and analyzing the timing of any children processes crashing. When the code determines such an exploit may be underway leveraging fork, all of the processes using the same memory contents are killed to stop whatever malicious activity may be happening.

The proposed patches spin this fork brute force attack detection and mitigation as a Kconfig build option. The behavior can also be controlled on a per-process basis using prctl. The thresholds around the detection are configurable via sysfs.

Should this new security measure be of interest to you, these initial patches after the prior RFC series can be found on the kernel mailing list for review and discussion.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via MichaelLarabel.com.

Popular News This Week