Messages in this thread |  | | Date | Fri, 13 Dec 2013 10:20:56 +0100 | From | Vegard Nossum <> | Subject | Re: [PATCH 1/9] Known exploit detection |
| |
On 12/13/2013 12:50 AM, Ryan Mallon wrote: > On 13/12/13 08:13, Kees Cook wrote: >> On Thu, Dec 12, 2013 at 11:06 AM, Theodore Ts'o <tytso@mit.edu> wrote: >>> On Thu, Dec 12, 2013 at 05:52:24PM +0100, vegard.nossum@oracle.com wrote: >>>> The idea is simple -- since different kernel versions are vulnerable to >>>> different root exploits, hackers most likely try multiple exploits before >>>> they actually succeed. > > The _exploit() notifications could also be used to spam the syslogs. > Although they are individually ratelimited, if there are enough > _exploit() markers in the kernel then an annoying person can cycle > through them all to generate large amounts of useless syslog.
They are rate limited collectively, not individually, so this should not be an issue.
Vegard
|  |