[ASA-202107-29] systemd: denial of service

[Jonas Witschel]

Arch Linux Security Advisory ASA-202107-29
==========================================

Severity: Low
Date    : 2021-07-14
CVE-ID  : CVE-2020-13529
Package : systemd
Type    : denial of service
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1935

Summary
=======

The package systemd before version 249-2 is vulnerable to denial of
service.

Resolution
==========

Upgrade to 249-2.

# pacman -Syu "systemd>=249-2"

The problem has been fixed upstream in version 249.

Workaround
==========

None.

Description
===========

An exploitable denial-of-service vulnerability exists in systemd-
networkd before version 249. A maliciously crafted DHCP FORCERENEW
packet can cause a server running the DHCP client to be vulnerable to a
DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW
and DCHP ACK packets to reconfigure the server.

Impact
======

A network-adjacent attacker could reconfigure the networking properties
of a device running systemd-networkd through crafted DHCP packets.

References
==========

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1142
https://github.com/systemd/systemd/issues/16774
https://github.com/systemd/systemd/pull/20002
https://github.com/systemd/systemd/commit/38e980a6a5a3442c2f48b1f827284388096d8ca5
https://security.archlinux.org/CVE-2020-13529
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20210716/64f92730/attachment.sig>