redoxOS Kernel Denial-of-Service Vulnerability via setitimer Syscall

A denial-of-service vulnerability has been identified in the redoxOS kernel, prior to the commit 5d41cd7c. This issue allows local attackers to cause a kernel panic by exploiting the setitimer syscall, leading to a divide-by-zero error.

Impact

Exploitation of this vulnerability causes a kernel panic, disrupting system operations and potentially leading to a crash.

Reproduction

The vulnerability can be reproduced by compiling a program that calls the setitimer syscall with invalid timer values, such as negative seconds and extremely large microsecond values. This program can then be executed to trigger the divide-by-zero panic in the kernel.

Remediation

Users can update to the latest version of the redoxOS kernel, where this vulnerability has been addressed.