Fork bomb

<h2 id="history">History</h2>
Around 1978, an early variant of a fork bomb called wabbit was reported to run on a <a href="/facts/IBM_System%2f360/7znvpy4K">System/360</a>. It may have descended from a similar attack called RABBITS reported from 1969 on a <a href="/facts/Burroughs_large_systems/FwY7EqrB">Burroughs 5500</a> at the <a href="/facts/University_of_Washington/36PG6qkG">University of Washington</a>.<a class="footnote-ref" id="fnref:1" href="#fn:1">1</a>

<h2 id="implementation">Implementation</h2>

Fork bombs operate both by consuming <a href="/facts/Central_processing_unit/Jxp1bqMV">CPU</a> time in the process of <a href="/facts/Fork_(system_call)/M1jtvaT4">forking</a>, and by saturating the <a href="/facts/Operating_system/8XTuvMh2">operating system</a>'s process table.<a class="footnote-ref" id="fnref:2" href="#fn:2">2</a><a class="footnote-ref" id="fnref:3" href="#fn:3">3</a> A basic implementation of a fork bomb is an <a href="/facts/Infinite_loop/NG4b7SFa">infinite loop</a> that repeatedly launches new copies of itself.
In <a href="/facts/Unix/0pNL2seI">Unix</a>-like operating systems, fork bombs are generally written to use the fork <a href="/facts/System_call/NW44AFJr">system call</a>.<a class="footnote-ref" id="fnref:4" href="#fn:4">4</a> As forked processes are also copies of the first program, once they resume execution from the next address at the <a href="/facts/Frame_pointer/1sMt713v">frame pointer</a>, they continue forking endlessly within their own copy of the same infinite loop. this has the effect of causing an <a href="/facts/Exponential_growth/m4yEqKJ7">exponential growth</a> in processes. As modern <a href="/facts/Unix/0pNL2seI">Unix systems</a> generally use a <a href="/facts/Copy-on-write/Vz5V8uMX">copy-on-write</a> resource management technique when forking new processes,<a class="footnote-ref" id="fnref:5" href="#fn:5">5</a> a fork bomb generally will not saturate such a system's memory.
<a href="/facts/Microsoft_Windows/bwhAhuSL">Microsoft Windows</a> operating systems do not have an equivalent functionality to the Unix fork system call;<a class="footnote-ref" id="fnref:6" href="#fn:6">6</a> a fork bomb on such an operating system must therefore create a new process instead of forking from an existing one, such as with <a href="/facts/Batch_file/E6wMVSyb">batch</a> echo %0^|%0 > $_.cmd & $_. In this batch script, %0|%0 is written to $_.cmd, which is then executed by & $_.<a class="footnote-ref" id="fnref:7" href="#fn:7">7</a>
A classic example of a fork bomb is one written in <a href="/facts/Unix_shell/2G4T2Fb9">Unix shell</a> :(){ :|:& };:, possibly dating back to 1999,<a class="footnote-ref" id="fnref:8" href="#fn:8">8</a> which can be more easily understood as

fork() {
 fork | fork &
}
fork

In it, a function is defined (fork()) as calling itself (fork), then <a href="/facts/Pipeline_(Unix)/EIhovuT2">piping</a> (|) its result into itself, all in a background <a href="/facts/Job_(Unix)/NIzeWzjq">job</a> (&).
The code using a colon : as the function name is not valid in a shell as defined by POSIX, which only permits <a href="/facts/Alphanumericals/ytA9RSIv">alphanumeric characters</a> and underscores in function names.<a class="footnote-ref" id="fnref:9" href="#fn:9">9</a> However, its usage is allowed in <a href="/facts/GNU_Bash/RrYLtEJT">GNU Bash</a> as an extension.<a class="footnote-ref" id="fnref:10" href="#fn:10">10</a>

<h2 id="prevention">Prevention</h2>
As a fork bomb's mode of operation is entirely encapsulated by creating new processes, one way of preventing a fork bomb from severely affecting the entire system is to limit the maximum number of processes that a single user may own. On Linux, this can be achieved by using the ulimit utility; for example, the command ulimit -u 30 would limit the affected user to a maximum of thirty owned processes.<a class="footnote-ref" id="fnref:11" href="#fn:11">11</a>
On <a href="/facts/Pluggable_authentication_module/g8lhxyUk">PAM</a>-enabled systems, this limit can also be set in /etc/security/limits.conf,<a class="footnote-ref" id="fnref:12" href="#fn:12">12</a>
and on *BSD, the system administrator can put limits in /etc/login.conf.<a class="footnote-ref" id="fnref:13" href="#fn:13">13</a>
Modern Linux systems also allow finer-grained fork bomb prevention through <a href="/facts/Cgroups/seJrzYuQ">cgroups</a> and process number (PID) controllers.<a class="footnote-ref" id="fnref:14" href="#fn:14">14</a>

<h2 id="see-also">See also</h2>
<ul><li><a href="/facts/Zip_bomb/IU35zhEc">Zip bomb</a></li>
<li><a href="/facts/Billion_laughs_attack/DgWa1pDl">Billion laughs attack</a></li>
<li><a href="/facts/Deadlock_(computer_science)/YDpdfnPP">Deadlock (computer science)</a></li>
<li><a href="/facts/Logic_bomb/btrj2258">Logic bomb</a></li>
<li><a href="/facts/Time_bomb_(software)/TBIlYy1P">Time bomb (software)</a></li></ul>

<h2 id="external-links">External links</h2>
<ul><li><a href="https://github.com/aaronryank/fork-bomb">Fork bomb examples</a> on <a href="/facts/GitHub/n1hNCsc3">GitHub</a></li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1">Raymond, Eric S. (October 1, 2004). "wabbit". The Jargon Lexicon. Archived from the original on May 15, 2012. Retrieved October 15, 2013. <a href="/wiki/Eric_S._Raymond" target="_blank">/wiki/Eric_S._Raymond</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></li>
<li id="fn:2">Ye, Nong (2008). Secure Computer and Network Systems: Modeling, Analysis and Design. John Wiley & Sons. p. 16. ISBN 978-0470023242. <a href="978-0470023242" target="_blank">978-0470023242</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></li>
<li id="fn:3">Jielin, Dong (2007). Network Dictionary. p. 200. ISBN 978-1602670006. <a href="978-1602670006" target="_blank">978-1602670006</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></li>
<li id="fn:4">Jielin, Dong (2007). Network Dictionary. p. 200. ISBN 978-1602670006. <a href="978-1602670006" target="_blank">978-1602670006</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></li>
<li id="fn:5">Dhamdhere, Dhananjay M. (2006). Operating Systems: A Concept-based Approach. McGraw-Hill Higher Education. p. 285. ISBN 0-07-061194-7. <a href="0-07-061194-7" target="_blank">0-07-061194-7</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></li>
<li id="fn:6">Hammond, Mark (2000). Python Programming On Win32: Help for Windows Programmers. "O'Reilly Media, Inc.". p. 35. ISBN 1565926218. <a href="1565926218" target="_blank">1565926218</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></li>
<li id="fn:7">Enderman (June 26, 2024). @echo.%0^|%0›$^_^.c^md&$_›nul. Retrieved June 30, 2024 – via YouTube. <a href="https://www.youtube.com/watch?v=SD_bg2VRTAc" target="_blank">https://www.youtube.com/watch?v=SD_bg2VRTAc</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></li>
<li id="fn:8">Michal Zalewski (August 19, 1999). "[RHSA-1999:028-01] Buffer overflow in libtermcap tgetent()". Newsgroup: muc.lists.bugtraq. Retrieved December 10, 2022. bash$ :(){ :|:&};:} <a href="https://groups.google.com/g/muc.lists.bugtraq/c/CH1RVi3TWZo" target="_blank">https://groups.google.com/g/muc.lists.bugtraq/c/CH1RVi3TWZo</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></li>
<li id="fn:9">"The Open Group Base Specifications Issue 7, 2018 edition IEEE Std 1003.1™-2017 Section 3.235". The Open Group/IEEE. Name: In the shell command language, a word consisting solely of underscores, digits, and alphabetics from the portable character set. The first character of a name is not a digit. <a href="https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_235" target="_blank">https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_235</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></li>
<li id="fn:10">"The GNU Bash Reference Manual, Section 3.3". Retrieved December 11, 2022. When the shell is in POSIX mode (see Bash POSIX Mode), fname must be a valid shell name and may not be the same as one of the special builtins (see Special Builtins). In default mode, a function name can be any unquoted shell word that does not contain '$'. <a href="https://www.gnu.org/software/bash/manual/bash.html#Shell-Functions" target="_blank">https://www.gnu.org/software/bash/manual/bash.html#Shell-Functions</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></li>
<li id="fn:11">Cooper, Mendel (2005). Advanced Bash Scripting Guide. pp. 305–306. ISBN 1430319305. <a href="1430319305" target="_blank">1430319305</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></li>
<li id="fn:12">Soyinka, Wale (2012). Linux Administration: A Beginners Guide. McGraw Hill Professional. pp. 364–365. ISBN 978-0071767590. <a href="978-0071767590" target="_blank">978-0071767590</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></li>
<li id="fn:13">Lucas, Michael W. (2007). Absolute FreeBSD: The Complete Guide to FreeBSD. No Starch Press. pp. 198–199. ISBN 978-1593271510. <a href="978-1593271510" target="_blank">978-1593271510</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></li>
<li id="fn:14">"Process Number Controller in Documentation/ as appeared in Linux kernel 5.3". October 8, 2019. Archived from the original on October 8, 2019. Retrieved October 8, 2019. <a href="https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/pids.html" target="_blank">https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/pids.html</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></li>
</ol>

Fork bomb open-in-new

Fork bomb