Date: Thu, 29 Sep 2016 12:12:00 -0500 From: Mark Hatle <mark.hatle@...driver.com> To: <oss-security@...ts.openwall.com> Subject: Systemd local denial of service Previously to the oss-security list there was a request for a CVE for a systemd issue from "agwa@...rewayer.name". (http://www.openwall.com/lists/oss-security/2016/09/28/9) The gravity of this request missed by attention, and I forwarded information of the blog: https://www.agwa.name/blog/post/how_to_crash_systemd_in_one_tweet to the distros@...openwall.org. Per policy, the post and related information is to also be sent to the oss-security list, as the information is public. > Just in case you have not seen this elsewhere.... > > https://www.agwa.name/blog/post/how_to_crash_systemd_in_one_tweet Relevant details: The following command, when run as any user, will crash systemd: NOTIFY_SOCKET=/run/systemd/notify systemd-notify "" After running this command, PID 1 is hung in the pause system call. You can no longer start and stop daemons. inetd-style services no longer accept connections. You cannot cleanly reboot the system. The system feels generally unstable (e.g. ssh and su hang for 30 seconds since systemd is now integrated with the login system). All of this can be caused by a command that's short enough to fit in a Tweet. ... The above systemd-notify command sends a zero-length message to the world-accessible UNIX domain socket located at /run/systemd/notify. PID 1 receives the message and fails an assertion that the message length is greater than zero. Despite the banality, the bug is serious, as it allows any local user to trivially perform a denial-of-service attack against a critical system component.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.