CVE-2016-7796: Input Validation
It was found that systemd fails an assertion in managerinvokenotifymessage() when a zero-length message is received over its notification socket, causing it to no longer perform it's expected functionality. This issue was assigned CVE-2016-7795 and is tracked via bug 1380286. Upstream bug report is:
https://github.com/systemd/systemd/issues/4234
Older systemd versions either don't include the assert that is triggered in managerinvokenotifymessage(), or have managerprocessnotifyfd() function return error before calling managerinvokenotifymessage(). That error return still causes systemd to exit its main loop and freeze its execution in a similar way it's done in newer versions after failed assertion.
https://github.com/systemd/systemd/issues/4234#issuecomment-250441246
The managerinvokenotifymessage() function with assert was introduced in version v209:
https://github.com/systemd/systemd/commit/5ba6985b6c8ef85a8bcfeb1b65239c863436e75b#diff-ab78220e12703ee63fa1e6a2caa16bebR1319
However, the assertion was not reachable before the error return was removed in v219:
https://github.com/systemd/systemd/commit/d875aa8ce10b458dc218c0d98f4a82c8904d6d03
The systemd versions in Red Hat Enterprise Linux 7.0 and 7.1 are based on upstream v208, but include managerinvokenotifymessage() added via a separate backported patch. The assertion is not reachable, so those versions are affected by CVE-2016-7796, but not affected by CVE-2016-7795. Red Hat Enterprise Linux 7.2 rebased systemd to version v219. Therefore, those packages are no longer affected by CVE-2016-7796, but are now affected by CVE-2016-7795.
Other sources
The managerdispatchnotifyfd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a notify socket, which causes an error to be returned and the notification handler to be disabled.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7796?
CVE-2016-7796 is rated as Important due to its potential to disrupt systemd's functionality.
How do I fix CVE-2016-7796?
To fix CVE-2016-7796, upgrade your systemd package to a version that is not vulnerable.
Which versions of systemd are affected by CVE-2016-7796?
CVE-2016-7796 affects systemd versions 209, 213, 214, and 229.
What are the possible consequences of CVE-2016-7796?
The consequences of CVE-2016-7796 may include system instability and loss of service functionality.
Is CVE-2016-7796 being actively exploited?
As of now, there is no evidence that CVE-2016-7796 is being actively exploited in the wild.