[arch-security] [ASA-201610-2] systemd: denial of service

[Levente Polyak]

Arch Linux Security Advisory ASA-201610-2
=========================================

Severity: High
Date    : 2016-10-04
CVE-ID  : CVE-2016-7795
Package : systemd
Type    : denial of service
Remote  : No
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package systemd before version 231-2 is vulnerable to denial of
service.

Resolution
==========

Upgrade to 231-2.

# pacman -Syu "systemd>=231-2"

The problem has been fixed upstream but no release is available yet.

Workaround
==========

None.

Description
===========

systemd fails an assertion in manager_invoke_notify_message when a
zero-length message is received over its notification socket. After
failing the assertion, PID 1 hangs in the pause system call. It is no
longer possible to start and stop daemons or cleanly reboot the system.
Inetd-style services managed by systemd no longer accept connections.
Since the notification socket, /run/systemd/notify, is world-writable,
this allows a local user to perform a denial-of-service attack against
systemd.
Proof-of-concept:
    NOTIFY_SOCKET=/run/systemd/notify systemd-notify ""

Impact
======

A local attacker is able to perform a denial of service attack by
obstructing start/stop of any daemons and clean reboot of the system.

References
==========

https://github.com/systemd/systemd/issues/4234
http://www.openwall.com/lists/oss-security/2016/09/28/9
https://access.redhat.com/security/cve/CVE-2016-7795

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20161004/c7bc6712/attachment.asc>