Arch Linux Security Advisory ASA-201901-9 ========================================= Severity: High Date : 2019-01-12 CVE-ID : CVE-2018-16864 CVE-2018-16865 Package : systemd Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-845 Summary ======= The package systemd before version 240.34-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 240.34-1. # pacman -Syu "systemd>=240.34-1" The problems have been fixed upstream in version 240.34. Workaround ========== None. Description =========== - CVE-2018-16864 (arbitrary code execution) A memory corruption vulnerability has been found in the journald component of systemd >= v230 and <= v240, in the set_iovec_field() function. Passing several megabytes of command-line arguments to a program that calls syslog() led to an attacker-controlled alloca(), which could be used to override the content of the memory, in the stack-clash fashion. - CVE-2018-16865 (arbitrary code execution) A memory corruption vulnerability has been found in the journald component of systemd >= v201 and <= v240, in the journal_file_append_entry() function. Sending a large "native" message to /run/systemd/journal/socket led to an attacker-controlled alloca(), which could be used to override the content of the memory, in the stack-clash fashion. Impact ====== A local attacker is able to execute arbitrary code by sending large log messages. References ========== https://www.qualys.com/2019/01/09/system-down/system-down.txt https://github.com/systemd/systemd/pull/11374 https://github.com/systemd/systemd/pull/11374/commits/084eeb865ca63887098e09... https://github.com/systemd/systemd/pull/11374/commits/052c57f132f04a3cf4148f... https://security.archlinux.org/CVE-2018-16864 https://security.archlinux.org/CVE-2018-16865