Re: CVE request: setrlimit can be avoided (Linux less than 2.6.22)

[Florian Weimer <fw () deneb enyo de>]

* Kees Cook:

> This rlimit-avoiding bug probably needs a CVE associated with it.  Users
> could avoid RLIMIT_CPU by setting it to "0".  The fixes in 2.6.17 did
> not actually fix the problem.
>
>
> Bugs:
>   https://launchpad.net/bugs/107209
>   http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=419706
>
> Fixed in 2.6.22:
>   
> http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=9926e4c74300c4b31dee007298c6475d33369df0

I doubt it's fixed completely.  I've seen spinning Java processes on
later kernel versions which drove up the load average, but were reported
as 0% CPU most of the time.

Or does RLIMIT_CPU use separate counters?