DKER-EE-002780 - PIDs cgroup limits must be used in Docker Enterprise.

Information

Use --pids-limit flag at container runtime.

Attackers could launch a fork bomb with a single command inside the container. This fork bomb can crash the entire system and requires a restart of the host to make the system functional again. PIDs cgroup --pids-limit will prevent this kind of attacks by restricting the number of forks that can happen inside a container at a given time.

The Default value for --pids-limit is 0 which means there is no restriction on the number of forks. Also, note that PIDs cgroup limit works only for the kernel versions 4.3+.

Solution

This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.

Use --pids-limit flag while launching the container with an appropriate value.

Example:
docker run -it --pids-limit 100 <Image_ID>
In the above example, the number of processes allowed to run at any given time is set to 100. After a limit of 100 concurrently running processes is reached, docker would restrict any new process creation.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Docker_Enterprise_2-x_Linux-Unix_V2R2_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5(2), CAT|II, CCI|CCI-001095, Rule-ID|SV-235828r961155_rule, STIG-ID|DKER-EE-002780, STIG-Legacy|SV-104827, STIG-Legacy|V-95689, Vuln-ID|V-235828

Plugin: Unix

Control ID: d9def88dec2f79d5cff7241442fa15cfc19a4f51cfa5f9b021e39dda87e20627