CVE-2016-7795: Input Validation
A flaw was found in the way systemd handled empty notification messages. A local attacker could use this flaw to make systemd freeze its execution, preventing further management of system services, system shutdown, or zombie process collection via systemd.
Other sources
It was found that systemd fails an assertion in managerinvokenotifymessage when a zero-length message is received over its notification socket. After failing the assertion, PID 1 hangs in the pause system call, making no longer possible to start and stop daemons or cleanly reboot the system. Inetd-style services managed by systemd no longer accept connections.
Since the notification socket, /run/systemd/notify, is world-writable, this allows a local user to perform a denial-of-service attack against systemd.
PoC:
NOTIFYSOCKET=/run/systemd/notify systemd-notify ""
Upstream bug report:
https://github.com/systemd/systemd/issues/4234
CVE request:
http://www.openwall.com/lists/oss-security/2016/09/28/9
The managerinvokenotifymessage function in systemd 231 and earlier allows local users to cause a denial of service (assertion failure and PID 1 hang) via a zero-length message received over a notify socket.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2016-7795?
CVE-2016-7795 is classified as a high severity vulnerability, affecting the stability of the systemd service manager.
How do I fix CVE-2016-7795?
To mitigate CVE-2016-7795, upgrade systemd to version 0:219-30.el7_3.3 or later for Red Hat systems, or ensure your systemd version is updated to 231 or newer for other distributions.
What systems are affected by CVE-2016-7795?
CVE-2016-7795 affects various versions of systemd, particularly on Red Hat Enterprise Linux 7 and Ubuntu 16.04.
Can CVE-2016-7795 cause system outages?
Yes, CVE-2016-7795 can lead to system outages by freezing systemd's execution, preventing service management.
Is CVE-2016-7795 a local or remote vulnerability?
CVE-2016-7795 is a local vulnerability, allowing local attackers to exploit the flaw.