Fork bomb

The concept behind a fork bomb — the processes continually replicate themselves, potentially causing a denial of service

In computing, a fork bomb is a denial-of-service attack whereby a process continually replicates itself to deplete available system resources.

Implementation

Fork bombs operate both by consuming CPU time in the process of forking, and by saturating the operating system's process table. A basic implementation of a fork bomb takes the following form:

set running to true
while running is true
    create copy of running process
end

In Unix-like operating systems, fork bombs are generally written to use the fork system call. As forked processes are also copies of the first program, once they resume execution from the next address at the frame pointer, they also seek to create a copy of themselves; this has the effect of causing an exponential growth in processes. As modern Unix systems generally use copy-on-write when forking new processes, a fork bomb generally will not saturate such a system's memory.

Microsoft Windows operating systems do not have equivalent functionality to the Unix fork system call; a fork bomb on such an operating system must therefore create a new process instead of forking from an existing one.

Prevention

As a fork bomb's mode of operation is entirely encapsulated by creating new processes, one way of preventing a fork bomb from severely affecting the entire system is to limit the maximum amount of processes that a single user may own. On Linux, this can be achieved by using the ulimit utility; for example, the command ulimit -Hu 30 would limit the affected user to a maximum of thirty owned processes. On PAM-enabled systems, this limit can also be set in /etc/security/limits.conf, and on FreeBSD, the system administrator can put limits in /etc/login.conf.

See also

• Deadlock
• Fork (operating system)
• Infinite loop