Bug 767299 (CVE-2011-4609)

Summary: CVE-2011-4609 glibc: svc_run() produces high cpu usage when accept() fails with EMFILE error
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: fweimer, law, mfranc, rcvalle, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=low,public=20110505,reported=20110505,source=redhat,cvss2=3.3/AV:A/AC:L/Au:N/C:N/I:N/A:P,rhel-4/glibc=affected,rhel-5/glibc=affected,rhel-6/glibc=affected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
A denial of service flaw was found in the remote procedure call (RPC) implementation in glibc. A remote attacker able to open a large number of connections to an RPC service that is using the RPC implementation from glibc, could use this flaw to make that service use an excessive amount of CPU time.
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-02-13 16:01:24 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 702300, 767685, 767687, 767688, 767692, 767693, 767696, 769360    
Bug Blocks: 767564    
Description Flags
patch to correct the flaw none

Description Vincent Danen 2011-12-13 13:34:58 EST
It was reported that if a process that called glibc's svc_run() exceeded the limit of opened files for a longer period of time, that accept() in rendezvous_request()/svcudp_recv() would fail with the EMFILE error, which would lead to looping between poll(), accept(), and 'for' loops which would consume a lot of CPU time.  This could lead to an unresponsive system that requires human intervention (service restart or system restart) to resolve.
Comment 2 Vincent Danen 2011-12-13 14:04:39 EST
Created attachment 546362 [details]
patch to correct the flaw
Comment 7 errata-xmlrpc 2012-01-24 16:17:55 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:0058 https://rhn.redhat.com/errata/RHSA-2012-0058.html
Comment 9 errata-xmlrpc 2012-02-13 15:35:21 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:0126 https://rhn.redhat.com/errata/RHSA-2012-0126.html
Comment 10 errata-xmlrpc 2012-02-13 15:35:55 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2012:0125 https://rhn.redhat.com/errata/RHSA-2012-0125.html