The fork bomb is a form of attack by Denial-of-service against a computing system using the function Fork. It is based on the assumption that the number of programs and process which can be carried out simultaneously on a computer is limited.

A fork bomb functions by creating a great number of processes very quickly in order to saturate space available in the list with the processes kept by the Operating system. If the table of the processes starts to saturate, no new program can start as long as no other finishes. Even if that arrives, it is not very probable that a useful program starts since the authorities of the bomb await each one to occupy this free site.

Not only the fork bombs use place in the table of the processes, but they use each one of time processor and the memory. Consequently, the system and the programs revolving at this time slow down and become even impossible to use.

The fork bomb can be regarded as a certain type of Wabbit (a program which car-counterpart without using network).

Examples

Among the traditional fork bombs

• perl - E " appear; fork while fork" & (forker by using the interpreter Perl)
• by using Shell Bash:

: () {: |: &};:

• In Microsoft Windows by using a file batch:

: S start cmd.exe goto S

note: one can replace cmd.exe by any other heavier program (while going in the file of the file using the order Cd c:\chemin _du_dossier for example).

• In language C:

#include int hand (void) { /* here one can add a Malloc to use more ressource*/ while (1) { fork (); } return 0; }

• In HTML, one can make open two pages within frameworks which open the same executives recursively:

For a named page forkbomb.htm :

Or then, for if the navigator blocks neither the popups nor the Javascript (always named page forkbomb.htm ):

Difficulty of cure

Once the fork bomb activated successfully in a system, it can become impossible to find a normal functioning without starting again, since the only solution with a fork bomb is to destroy all its authorities. To try to use a program to kill the processes requires the creation of a process, which can be impossible if there is no empty site in the table of the processes, or of space in the structures memory.

Prevention

The fork bomb functions by creating as much process than possible. Thus, to prevent a fork bomb, it is simply enough to limit the number of process which can be carried out by a program or a user. By allowing to the users not-confidence to launch only one small number of process, the danger of a fork bomb, intentional or not, is reduced. However, that does not prevent a user group from collaborating to consume the sites process, unless the total limit of the processes is larger than the sum of the individual limits of the processes.

Protection under Unix

The systems of the type Unix make it possible to limit the number of processes via the order ulimit . In a Linux core, this limit can be indicated via RLIMIT_NPROC . If a process calls fork and that the user then has already more RLIMIT_NPROC process the fork fails. Here still the limitation is specific to a given user and does not allow to thwart the simultaneous attacks by several users. It makes it possible however to limit the impact of forks accidental, for example when designing of a software or a bug in an application.

Random links:

Magellan Strait | Laila Ali | Bosnians | Port Authority Organizes Department | Kimberley (Australia) | Évêque_pin