Arch Linux Security Advisory ASA-201610-2

Severity: High
Date : 2016-10-04
CVE-ID : CVE-2016-7795
Package : systemd
Type : denial of service
Remote : No
Link : https://wiki.archlinux.org/index.php/CVE

Summary

The package systemd before version 231-2 is vulnerable to denial of
service.

Resolution

Upgrade to 231-2.

pacman -Syu “systemd>=231-2”

The problem has been fixed upstream but no release is available yet.

Workaround

None.

Description

systemd fails an assertion in manager_invoke_notify_message when a
zero-length message is received over its notification socket. After
failing the assertion, PID 1 hangs in the pause system call. It is no
longer possible to start and stop daemons or cleanly reboot the system.
Inetd-style services managed by systemd no longer accept connections.
Since the notification socket, /run/systemd/notify, is world-writable,
this allows a local user to perform a denial-of-service attack against
systemd.
Proof-of-concept:
NOTIFY_SOCKET=/run/systemd/notify systemd-notify “”

Impact

A local attacker is able to perform a denial of service attack by
obstructing start/stop of any daemons and clean reboot of the system.

References

https://github.com/systemd/systemd/issues/4234
http://www.openwall.com/lists/oss-security/2016/09/28/9
https://access.redhat.com/security/cve/CVE-2016-7795