[ASA-201901-9] systemd: arbitrary code execution

[Jelle van der Waa]

Arch Linux Security Advisory ASA-201901-9
=========================================

Severity: High
Date    : 2019-01-12
CVE-ID  : CVE-2018-16864 CVE-2018-16865
Package : systemd
Type    : arbitrary code execution
Remote  : No
Link    : https://security.archlinux.org/AVG-845

Summary
=======

The package systemd before version 240.34-1 is vulnerable to arbitrary
code execution.

Resolution
==========

Upgrade to 240.34-1.

# pacman -Syu "systemd>=240.34-1"

The problems have been fixed upstream in version 240.34.

Workaround
==========

None.

Description
===========

- CVE-2018-16864 (arbitrary code execution)

A memory corruption vulnerability has been found in the journald
component of systemd >= v230 and <= v240, in the set_iovec_field()
function. Passing several megabytes of command-line arguments to a
program that calls syslog() led to an attacker-controlled alloca(),
which could be used to override the content of the memory, in the
stack-clash fashion.

- CVE-2018-16865 (arbitrary code execution)

A memory corruption vulnerability has been found in the journald
component of systemd >= v201 and <= v240, in the
journal_file_append_entry() function. Sending a large "native" message
to /run/systemd/journal/socket led to an attacker-controlled alloca(),
which could be used to override the content of the memory, in the
stack-clash fashion.

Impact
======

A local attacker is able to execute arbitrary code by sending large log
messages.

References
==========

https://www.qualys.com/2019/01/09/system-down/system-down.txt
https://github.com/systemd/systemd/pull/11374
https://github.com/systemd/systemd/pull/11374/commits/084eeb865ca63887098e0945fb4e93c852b91b0f
https://github.com/systemd/systemd/pull/11374/commits/052c57f132f04a3cf4148f87561618da1a6908b4
https://security.archlinux.org/CVE-2018-16864
https://security.archlinux.org/CVE-2018-16865
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20190114/1d09fd21/attachment.asc>