kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. An attack does not affect the stability of the kernel; it only causes mismanagement of application execution.)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
72AC7518-B872-42E3-A43B-F2D010211A8D
5.3.9
OR
cpe:2.3:a:oracle:sd-wan_edge:8.2:*:*:*:*:*:*:*
78C99571-0F3C-43E6-84B3-7D80E045EF8E
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
CD783B0C-9246-47D9-A937-6144FE8BFF0F
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43
OR
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
3A756737-1CC4-42C2-A4DF-E1C893B4E2D5
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
5C2089EE-5D7F-47EC-8EA5-0F69790564C4
cpe:2.3:a:netapp:data_availability_services:-:*:*:*:*:*:*:*
0EF46487-B64A-454E-AECC-D74B83170ACD
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*
A0DA944C-4992-424D-BC82-474585DAC5DF
11.70.2
11.0
cpe:2.3:a:netapp:fas\/aff_baseboard_management_controller:-:*:*:*:*:*:*:*
66EEA3CA-8CC7-4F0B-8204-6132D4114873
cpe:2.3:a:netapp:hci_baseboard_management_controller:h610s:*:*:*:*:*:*:*
DE7C6010-F736-4BDA-9E3B-C4370BBFA149
cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
D6D700C5-F67F-4FFB-BE69-D524592A3D2E
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
E94F7F59-1785-493F-91A7-5F5EA5E87E4D
cpe:2.3:h:netapp:aff_baseboard_management_controller:a700:*:*:*:*:*:*:*
49E3F452-73D7-465E-BC76-5B0DA75240A9
cpe:2.3:h:netapp:solidfire_baseboard_management_controller:-:*:*:*:*:*:*:*
090AA6F4-4404-4E26-82AB-C3A22636F276
OR
> /kind bug

This is not a bug in Kubernets per se, it's more of a heads-up.

I've read this great blog post:

* https://kubernetes.io/blog/2018/07/24/feature-highlight-cpu-manager/

From the blog post I learned that k8s is using cfs quotas to enforce CPU limits. Unfortunately, those can lead to unnecessary throttling, especially for well behaved tenants.

See this unresolved bug in Linux kernel I filed a while back:

* https://bugzilla.kernel.org/show_bug.cgi?id=198197

There's an open and stalled patch that addresses the issue (I've not verified if it works):

* https://lore.kernel.org/patchwork/cover/907448/

cc @ConnorDoyle @balajismaniam
CFS quotas can lead to unnecessary throttling
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : CFS quotas can lead to unnecessary throttling
Issue date:

--- start body ---
> /kind bug

This is not a bug in Kubernets per se, it's more of a heads-up.

I've read this great blog post:

* https://kubernetes.io/blog/2018/07/24/feature-highlight-cpu-manager/

From the blog post I learned that k8s is using cfs quotas to enforce CPU limits. Unfortunately, those can lead to unnecessary throttling, especially for well behaved tenants.

See this unresolved bug in Linux kernel I filed a while back:

* https://bugzilla.kernel.org/show_bug.cgi?id=198197

There's an open and stalled patch that addresses the issue (I've not verified if it works):

* https://lore.kernel.org/patchwork/cover/907448/

cc @ConnorDoyle @balajismaniam
--- end body ---

comments :
--- start comments ---

--- end comments ---