group.of.nepali.translators team mailing list archive

Thread
Date

[Bug 1628687] Re: Assertion failure when PID 1 receives a zero-length message over notify socket

To: group.of.nepali.translators@xxxxxxxxxxxxxxxxxxx
From: Launchpad Bug Tracker <1628687@xxxxxxxxxxxxxxxxxx>
Date: Thu, 29 Sep 2016 06:45:53 -0000
Reply-to: Bug 1628687 <1628687@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx

This bug was fixed in the package systemd - 229-4ubuntu10

---------------
systemd (229-4ubuntu10) xenial-security; urgency=medium

  * SECURITY UPDATE: zero-length notify message triggers abort/denial of
    service
    - systemd-dont_assert_on_zero_length_message-lp1628687.patch: change
      assert to simple return + log (LP: #1628687)
    - Thanks to Jorge Niedbalski <jorge.niedbalski@xxxxxxxxxxxxx> for
      the patch.

 -- Steve Beattie <sbeattie@xxxxxxxxxx>  Wed, 28 Sep 2016 14:21:42 -0700

** Changed in: systemd (Ubuntu Xenial)
       Status: Confirmed => Fix Released

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1628687

Title:
  Assertion failure when PID 1 receives a zero-length message over
  notify socket

Status in systemd:
  Unknown
Status in systemd package in Ubuntu:
  Confirmed
Status in systemd source package in Xenial:
  Fix Released
Status in systemd source package in Yakkety:
  Confirmed

Bug description:
  Environment:

  Xenial 16.04.1
  Amd64

  Description.

  Systemd fails an assertion in manager_invoke_notify_message when a
  zero-length message is received over /run/systemd/notify. This allows
  a local user to perform a denial-of-service attack against PID 1.

  How to trigger the bug:

  $ while true; do NOTIFY_SOCKET=/run/systemd/notify systemd-notify "";
  done

  The following entries are written into /var/log/syslog, at this point
  systemd is crashed.

  Sep 28 20:57:20 ubuntu systemd[1]: Started User Manager for UID 1000.
  Sep 28 20:57:28 ubuntu systemd[1]: Assertion 'n > 0' failed at ../src/core/manager.c:1501, function manager_invoke_notify_message(). Aborting.
  Sep 28 20:57:29 ubuntu systemd[1]: Caught <ABRT>, dumped core as pid 1307.
  Sep 28 20:57:29 ubuntu systemd[1]: Freezing execution.

  
  Public bug: https://github.com/systemd/systemd/issues/4234

To manage notifications about this bug go to:
https://bugs.launchpad.net/systemd/+bug/1628687/+subscriptions