[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 29 Sep 2016 12:12:00 -0500
From: Mark Hatle <mark.hatle@...driver.com>
To: <oss-security@...ts.openwall.com>
Subject: Systemd local denial of service
Previously to the oss-security list there was a request for a CVE for a systemd
issue from "agwa@...rewayer.name".
(http://www.openwall.com/lists/oss-security/2016/09/28/9)
The gravity of this request missed by attention, and I forwarded information of
the blog: https://www.agwa.name/blog/post/how_to_crash_systemd_in_one_tweet to
the distros@...openwall.org. Per policy, the post and related information is to
also be sent to the oss-security list, as the information is public.
> Just in case you have not seen this elsewhere....
>
> https://www.agwa.name/blog/post/how_to_crash_systemd_in_one_tweet
Relevant details:
The following command, when run as any user, will crash systemd:
NOTIFY_SOCKET=/run/systemd/notify systemd-notify ""
After running this command, PID 1 is hung in the pause system call. You can no
longer start and stop daemons. inetd-style services no longer accept
connections. You cannot cleanly reboot the system. The system feels generally
unstable (e.g. ssh and su hang for 30 seconds since systemd is now integrated
with the login system). All of this can be caused by a command that's short
enough to fit in a Tweet.
...
The above systemd-notify command sends a zero-length message to the
world-accessible UNIX domain socket located at /run/systemd/notify. PID 1
receives the message and fails an assertion that the message length is greater
than zero. Despite the banality, the bug is serious, as it allows any local user
to trivially perform a denial-of-service attack against a critical system component.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
