https://seclists.org/oss-sec/2019/q1/179
Affected Software
Frequently Asked Questions
Which deployments are known to be exposed to the incorrect filter generation?
A search cited in the advisory found that systemd and Tor appeared to be the only consumers using libseccomp in a way that triggers the faulty code. For systemd, the affected filters concern socket address families and scheduling classes; for Tor, they may affect memory addresses supplied to mprotect(2).
What condition is required to trigger the problem?
The application must use libseccomp to generate 64-bit syscall argument comparisons with the LT, GT, LE, or GE arithmetic operators. The issue is in the generated comparisons, not merely in the presence of libseccomp.
Is there a workaround if an immediate upgrade is not possible?
No workaround was known at the time of the advisory. Administrators and distributors were encouraged to upgrade to libseccomp 2.4.0 as soon as possible.
Can the fix be obtained through a 2.3.x update?
No. The fix was released in libseccomp 2.4.0 and was not backported to the 2.3.x release stream because of the complexity and risk of backporting it. Version 2.4.0 is described as a direct drop-in replacement for prior 2.x releases.