An account permitted to install a crontab can substantially delay the
central cron daemon by supplying many environment assignments.
Debian's crontab command validates these assignments cheaply, while
the daemon repeatedly scans and reallocates its growing environment
during load_user(). With many distinct names sharing long prefixes,
loading grows approximately quadratically.

Isolated measurements on the packaged code: 1,000 assignments parsed
in 0.23 s; 8,000 in 14.35 s. A 9.28 MB crontab was accepted by
crontab(1) in about 0.2 s, then took about 22 s in the daemon's
database-loading path. Changing and reloading it incurred a similar
delay. We have not established the maximum practical delay or
demonstrated an out-of-memory failure. The daemon loads synchronously,
so other jobs can be delayed during the parse.

The attached Debian -212 quilt patch replaces repeated linear
environment-name lookup with a balanced index and geometrically grown
ordered vector, retaining last-value-wins and assignment order. It
also adds a 16 MiB whole-crontab size limit and a 16 MiB accounting
budget for copied job environments. Comments count toward file size
but are skipped by environment parsing. The budget is conservative for
repeated replacements. Both limits are checked at installation and
load time, with recovery when an oversized system file is corrected.

The patched Debian source built in a disposable trixie container. All
13 existing Debian integration tests passed, as did focused
environment, allocation-failure, installer-budget and loader-recovery
tests. The patch includes regression sources; build/test integration
for the complete patch series is available on request.

This affects Ubuntu cron 3.0pl1-200ubuntu1 and -209ubuntu1 as well.
Debian and Ubuntu Security Teams reviewed the findings and recommended
public bug reports. No privilege escalation was demonstrated.

Regards,
Brett Sutton