diff options
| author | Stefan Hajnoczi <stefanha@redhat.com> | 2020-05-01 15:06:44 +0100 |
|---|---|---|
| committer | Dr. David Alan Gilbert <dgilbert@redhat.com> | 2020-05-01 18:41:56 +0100 |
| commit | 8c1d353d107b4fc344e27f2f08ea7fa25de2eea2 (patch) | |
| tree | bb20ce88beefdd687a4c4eac62820dbaafe8c1d6 /util/qemu-timer.c | |
| parent | 6dbb716877728ce4eb51619885ef6ef4ada9565f (diff) | |
| download | focaccia-qemu-8c1d353d107b4fc344e27f2f08ea7fa25de2eea2.tar.gz focaccia-qemu-8c1d353d107b4fc344e27f2f08ea7fa25de2eea2.zip | |
virtiofsd: stay below fs.file-max sysctl value (CVE-2020-10717)
The system-wide fs.file-max sysctl value determines how many files can be open. It defaults to a value calculated based on the machine's RAM size. Previously virtiofsd would try to set RLIMIT_NOFILE to 1,000,000 and this allowed the FUSE client to exhaust the number of open files system-wide on Linux hosts with less than 10 GB of RAM! Take fs.file-max into account when choosing the default RLIMIT_NOFILE value. Fixes: CVE-2020-10717 Reported-by: Yuval Avrahami <yavrahami@paloaltonetworks.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20200501140644.220940-3-stefanha@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Diffstat (limited to 'util/qemu-timer.c')
0 files changed, 0 insertions, 0 deletions