[arch-security] [ASA-201610-2] systemd: denial of service
anthraxx at archlinux.org
Tue Oct 4 13:29:17 UTC 2016
Arch Linux Security Advisory ASA-201610-2
Date : 2016-10-04
CVE-ID : CVE-2016-7795
Package : systemd
Type : denial of service
Remote : No
Link : https://wiki.archlinux.org/index.php/CVE
The package systemd before version 231-2 is vulnerable to denial of
Upgrade to 231-2.
# pacman -Syu "systemd>=231-2"
The problem has been fixed upstream but no release is available yet.
systemd fails an assertion in manager_invoke_notify_message when a
zero-length message is received over its notification socket. After
failing the assertion, PID 1 hangs in the pause system call. It is no
longer possible to start and stop daemons or cleanly reboot the system.
Inetd-style services managed by systemd no longer accept connections.
Since the notification socket, /run/systemd/notify, is world-writable,
this allows a local user to perform a denial-of-service attack against
NOTIFY_SOCKET=/run/systemd/notify systemd-notify ""
A local attacker is able to perform a denial of service attack by
obstructing start/stop of any daemons and clean reboot of the system.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 801 bytes
Desc: OpenPGP digital signature
More information about the arch-security