CVE-1999-1518

Vulnerability

CVE-1999-1518 describes a vulnerability in operating systems with shared memory implementations derived from BSD 4.4 code [1]. A local user can bypass memory limits, such as those enforced by resource limits (rlimits), by using mmap() or shmget() to allocate large amounts of shared memory and then triggering page faults to force physical memory allocation [1]. The affected systems include FreeBSD, Linux, and Irix, though the exact versions are not specified in the reference [1].

Exploitation

An attacker with local user access to the system can call mmap() or shmget() to request a large shared memory segment [1]. Then, the attacker triggers page faults across the entire allocated region, causing the operating system to page in the data from the file or swap, ultimately consuming all available physical memory [1]. The attack does not require special privileges beyond local user access [1].

Impact

Successful exploitation results in a denial of service (DoS) condition where the system exhausts its memory, potentially causing the kernel to kill the offending process or the system to become unresponsive [1]. With System V IPC, shared memory segments persist even after the process terminates, so the memory remains consumed and unavailable to the system until explicitly destroyed or the system is rebooted [1]. The attacker does not achieve code execution or data compromise; the impact is purely availability [1].

Mitigation

Not yet disclosed in the available references. The referenced Bugtraq post [1] from 1999 does not provide a specific fix, patch, or workaround. Administrators may consider restricting local access to trusted users or monitoring shared memory usage as temporary measures. No CVE assignment or vendor advisories regarding a fix are mentioned in the provided reference.