Fork bomb

From Free net encyclopedia

The fork bomb is a form of denial of service attack against a computer system that uses the fork function. It relies on the assumption that the number of programs and processes which may be simultaneously executed on a computer has a limit.

A fork bomb works by creating a large number of processes very quickly in order to saturate the available space in the list of processes kept by the computer's operating system. If the process table becomes saturated, no new programs may be started until another terminates. Even if that happens, it is not likely that a useful program may be started since the instances of the bomb program are each waiting to take that slot themselves.

Not only do fork bombs use space in the process table, they each use processor time and memory. As a result of this, the system and existing programs running on it become much more difficult (slow), or even impossible, to use.

Fork bombs can be considered as a special type of wabbit (a program that self-replicates without using hosts or network functionality).

Although most fork bombs use "fork while fork", a system can be taken down more quickly with "fork while 1". Canonical forkbombs include perl -e "fork while fork" & (forking using the Perl interpreter) and :(){ :|:& };: (using the Bash shell) (Explanation).

Or in Microsoft Windows using a batch file:

:s
start %0
goto s

Or in C:

#include <unistd.h>

int main(void)
{
  while(1) { 
    fork(); 
  } 
  return 0; 
} 

Difficulty of cure

Once a successful fork bomb has been activated in a system it may not be possible to resume normal operation without rebooting, as the only solution to a fork bomb is to destroy all instances of it. Trying to use a program to kill the rogue processes normally requires another process be created, which may not be possible if there are no empty slots in the process table, or space in memory structures.

Prevention

The way in which a fork bomb functions is to spawn as many processes as possible; thus, to prevent a fork bomb one simply needs to limit the number of processes which may be produced by a single program or user. By allowing untrusted users to run only a relatively small number of processes, the danger of a fork bomb, malicious or unintentional, is reduced. However, this does not prevent the possibility of a group of users collaborating to consume process slots unless the overall process limit is higher than the sum of the process limits of the users in the group.fr:Fork bomb pl:Fork-bomba