Apparently Apple doesn't think this is a security issue:
https://groups.google.com/forum/m/#!topic/nix-devel/KV9eomId...
Unprivileged users being able to panic the kernel would seem to be security related, but I am just an amateur.
There was an anecdote in the issue tracker that suggested there was some level of privilege escalation but that did not contain a repro or any supporting evidence.
Therefore any issue which impacts the availability of a service or device is a security issue.
[1] https://en.wikipedia.org/wiki/Information_security#Key_conce...
To make this really simple, imagine if I ran a fork bomb on one server. That makes the server unavailable for users who want to log into it for whatever reason. Therefore it is a security issue.
It doesn't matter if its an end user device, one sever or a distributed system. I as the user cannot do what I want to do. That is what 'availability' means in the CIA triad.
The discussion linked from the github issue sounds like "kill SIGKILL -1" at a shell prompt is enough to trigger the issue. That just requires a shell, not local system access.
> and the ability to send kill signals to arbitrary process IDs
This is precisely the part that is _not_ required but should be.