Bug 248113 (CVE-2007-3719)

Summary: CVE-2007-3719 kernel: secretly Monopolizing the CPU Without Superuser Privileges
Product: [Other] Security Response Reporter: Marcel Holtmann <holtmann>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: low    
Version: unspecifiedCC: anton, dhoward, jbaron, kernel-mgr, kreilly, lwang, pzijlstr
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-12-23 01:26:50 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 297671, 297681, 297691, 297701, 297711, 297721, 297731    
Bug Blocks:    

Description Marcel Holtmann 2007-07-13 11:24:33 UTC 
The process scheduler in the Linux kernel 2.6.16 gives preference to
"interactive" processes that perform voluntary sleeps, which allows local users
to cause a denial of service (CPU consumption), as described in "Secretly
Monopolizing the CPU Without Superuser Privileges."

http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
Comment 13 Eugene Teo (Security Response) 2010-12-23 01:26:50 UTC 
Statement CVE-2007-3719:

The Red Hat Security Response Team has rated this issue as having moderate security impact.

The risks associated with fixing this bug are greater than the moderate severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 3, 4, 5, and Red Hat Enterprise MRG.