Bug 767299 (CVE-2011-4609)

Summary: CVE-2011-4609 glibc: svc_run() produces high cpu usage when accept() fails with EMFILE error
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: fweimer, law, mfranc, rcvalle, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
A denial of service flaw was found in the remote procedure call (RPC) implementation in glibc. A remote attacker able to open a large number of connections to an RPC service that is using the RPC implementation from glibc, could use this flaw to make that service use an excessive amount of CPU time.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2012-02-13 21:01:24 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 702300, 767685, 767687, 767688, 767692, 767693, 767696, 769360    
Bug Blocks: 767564    
Attachments:
Description Flags
patch to correct the flaw none

Description Vincent Danen 2011-12-13 18:34:58 UTC 
It was reported that if a process that called glibc's svc_run() exceeded the limit of opened files for a longer period of time, that accept() in rendezvous_request()/svcudp_recv() would fail with the EMFILE error, which would lead to looping between poll(), accept(), and 'for' loops which would consume a lot of CPU time.  This could lead to an unresponsive system that requires human intervention (service restart or system restart) to resolve.
Comment 2 Vincent Danen 2011-12-13 19:04:39 UTC 
Created attachment 546362 [details]
patch to correct the flaw
Comment 7 errata-xmlrpc 2012-01-24 21:17:55 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:0058 https://rhn.redhat.com/errata/RHSA-2012-0058.html
Comment 9 errata-xmlrpc 2012-02-13 20:35:21 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:0126 https://rhn.redhat.com/errata/RHSA-2012-0126.html
Comment 10 errata-xmlrpc 2012-02-13 20:35:55 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2012:0125 https://rhn.redhat.com/errata/RHSA-2012-0125.html