Problem Description:
Due to a programming error, blocklistd leaks a socket descriptor
for each adverse event report it receives.
Once a certain number of leaked sockets is reached, blocklistd
becomes unable to run the helper script: a child process is forked,
but this child dereferences a null pointer and crashes before it
is able to exec the helper. At this point, blocklistd still records
adverse events but is unable to block new addresses or unblock
addresses whose database entries have expired.
Once a second, much higher number of leaked sockets is reached,
blocklistd becomes unable to receive new adverse event reports.
Impact:
An attacker may take advantage of this by triggering a large
number of adverse events from sacrificial IP addresses to effectively
disable blocklistd before launching an attack.
Even in the absence of attacks or probes by would-be attackers,
adverse events will occur regularly in the course of normal operations,
and blocklistd will gradually run out file descriptors and become
ineffective.
The accumulation of open sockets may have knock-on effects on other
parts of the system, resulting in a general slowdown until blocklistd
is restarted.