REDHAT-BUG-1380286: Medium severity systemd vulnerability

Published Sep 29, 2016

Updated

It was found that systemd fails an assertion in managerinvokenotifymessage when a zero-length message is received over its notification socket. After failing the assertion, PID 1 hangs in the pause system call, making no longer possible to start and stop daemons or cleanly reboot the system. Inetd-style services managed by systemd no longer accept connections.

Since the notification socket, /run/systemd/notify, is world-writable, this allows a local user to perform a denial-of-service attack against systemd.

PoC:

NOTIFYSOCKET=/run/systemd/notify systemd-notify ""

Upstream bug report:

https://github.com/systemd/systemd/issues/4234

CVE request:

http://www.openwall.com/lists/oss-security/2016/09/28/9

Affected Software

1 affected component

systemd systemd

Event History

Sep 29, 2016

Data Sourced

08:22 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1380286?

REDHAT-BUG-1380286 is considered a critical vulnerability as it causes PID 1 to hang, preventing the starting and stopping of daemons.

How do I fix REDHAT-BUG-1380286?

To fix REDHAT-BUG-1380286, update systemd to the latest version provided by your distribution that includes a patch for this vulnerability.

What is the impact of REDHAT-BUG-1380286 on system operations?

The impact of REDHAT-BUG-1380286 is significant as it inhibits system management tasks, including starting, stopping daemons, and rebooting the system.

Is there a workaround for REDHAT-BUG-1380286?

One potential workaround for REDHAT-BUG-1380286 is to avoid sending zero-length messages over the notification socket.

What systems are affected by REDHAT-BUG-1380286?

Systems running the vulnerable versions of systemd are affected by REDHAT-BUG-1380286.