882769 – (CVE-2022-45873) <sys-apps/systemd-252.0: deadlock in systemd-coredump

Bug 882769 (CVE-2022-45873) - <sys-apps/systemd-252.0: deadlock in systemd-coredump

Summary: <sys-apps/systemd-252.0: deadlock in systemd-coredump

Status:	IN_PROGRESS

Alias:	CVE-2022-45873

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal normal (vote)
Assignee:	Gentoo Security

URL:	https://github.com/systemd/systemd/co...
Whiteboard:	A3 [glsa]
Keywords:

Depends on:	887749
Blocks:
	Show dependency tree

Reported:	2022-11-24 15:28 UTC by John Helmert III
Modified:	2024-04-14 07:21 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2022-11-24 15:28:50 UTC

CVE-2022-45873 (https://github.com/systemd/systemd/pull/25055#issuecomment-1313733553):

systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology is to crash a binary calling the same function recursively, and put it in a deeply nested directory to make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16 is set for the systemd/units/systemd-coredump.socket file.

Seems like this should be backported?

Comment 1 Mike Gilbert gentoo-dev

2022-11-24 15:40:36 UTC

The backport is not trivial; it may be better to wait for a backport upstream, or stabilize systemd-252.

Comment 2 John Helmert III archtester

2023-01-13 20:46:32 UTC

Thanks!