Bug 595476 – <sys-apps/systemd-233-r1: local user DoS

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Kristian Fiskerstrand (RETIRED) 2016-09-28 22:07:53 UTC]

From ${URL}:
systemd[1] fails an assertion in manager_invoke_notify_message[2] when
a zero-length message is received over its notification socket.
After failing the assertion, PID 1 hangs in the pause system call.
It is no longer possible to start and stop daemons or cleanly reboot
the system. Inetd-style services managed by systemd no longer accept
connections.

Since the notification socket, /run/systemd/notify, is world-writable,
this allows a local user to perform a denial-of-service attack against
systemd.

Proof-of-concept:

        NOTIFY_SOCKET=/run/systemd/notify systemd-notify ""

This vulnerability is present in all versions of systemd since at
least v209[3].

This has been reported to systemd.[4]

[1] https://github.com/systemd/systemd/
[2] https://github.com/systemd/systemd/blob/b8fafaf4a1cffd02389d61ed92ca7acb1b8c739c/src/core/manager.c#L1666
[3] https://github.com/systemd/systemd/commit/5ba6985b6c8ef85a8bcfeb1b65239c863436e75b#diff-ab78220e12703ee63fa1e6a2caa16bebR1325
[4] https://github.com/systemd/systemd/issues/4234

[Comment 1 Agostino Sarubbo 2016-09-29 13:27:22 UTC]

Patch:
https://github.com/systemd/systemd/commit/531ac2b2349da02acc9c382849758e07eb92b020

[Comment 2 Mike Gilbert 2016-09-29 14:24:45 UTC]

There's still some chatter on this upstream. I'm waiting a bit to see if this PR gets merged.

https://github.com/systemd/systemd/pull/4242

[Comment 3 Mike Gilbert 2016-09-30 01:39:14 UTC]

Backporting the fix(es) to systemd-226 is non-trivial.

system-231 has some regressions, the fixes for which are also non-trivial backports.

I would prefer to wait for upstream to release systemd-232 to resolve this.

[Comment 4 Thomas Deutschmann (RETIRED) 2016-11-18 16:24:41 UTC]

The PR was merged and first release containing the fix was =sys-apps/systemd-232 which already landed in the Gentoo repository: https://gitweb.gentoo.org/repo/gentoo.git/commit/sys-apps/systemd?id=1aac346933936be0fca1b24cac3ba2a147b08c6f


@ maintainer(s): Please tell us how to proceed. Is systemd-232 ready for stabilization?

[Comment 5 Mike Gilbert 2016-11-18 16:48:21 UTC]

(In reply to Thomas Deutschmann from comment #4)
> @ maintainer(s): Please tell us how to proceed. Is systemd-232 ready for
> stabilization?

No, systemd-232 introduced additional regressions and is not fit for stabilization.

See bug 598992, bug 599152.

[Comment 6 Yury German 2017-04-21 00:39:54 UTC]

Maintainer(s), please advise if you are ready for stabilization or call for stabilization yourself.

[Comment 7 Mike Gilbert 2017-04-21 01:17:24 UTC]

Let's proceed with systemd-233-r1.

I have taken the liberty of adding sys-libs/libseccomp to the package list to satisfy a dependency.

[Comment 8 Agostino Sarubbo 2017-04-23 21:23:24 UTC]

amd64 stable

[Comment 9 Agostino Sarubbo 2017-04-27 10:36:55 UTC]

x86 stable

[Comment 10 Agostino Sarubbo 2017-04-27 11:23:41 UTC]

sparc stable

[Comment 11 Agostino Sarubbo 2017-04-29 15:02:32 UTC]

ppc stable

[Comment 12 Agostino Sarubbo 2017-04-30 09:37:25 UTC]

ppc64 stable

[Comment 13 Tobias Klausmann (RETIRED) 2017-05-22 17:30:45 UTC]

Stable on alpha.

[Comment 14 Agostino Sarubbo 2017-06-10 15:11:06 UTC]

ia64 stable

[Comment 15 Mike Gilbert 2017-06-28 17:07:13 UTC]

arm should now stabilize 233-r2 instead (bug 622874).

[Comment 16 Aaron Bauman (RETIRED) 2017-10-08 19:50:10 UTC]

GLSA Vote: No