Bug#839607: Robustify manager_dispatch_notify_fd()

From	Salvatore Bonaccorso <carnil@debian.org>
Newsgroups	linux.debian.bugs.dist, linux.debian.security
Subject	Bug#839607: Robustify manager_dispatch_notify_fd()
Date	2016-10-03 14:00 +0200
Message-ID	<soa4x-4oL-5@gated-at.bofh.it> (permalink)
References	<so4Vc-tK-3@gated-at.bofh.it> <so8vL-3Dr-11@gated-at.bofh.it> <so8YN-3N9-7@gated-at.bofh.it> <so8YN-3N9-11@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

Hi,

On Mon, Oct 03, 2016 at 12:48:15PM +0200, Florian Weimer wrote:
> * Michael Biebl:
> 
> > Dear security team, I'd appreciate your input on bug #839607
> 
> It's a bug, and it should be fixed in stable, probably in a point
> update.

Agreed, and fixing via point release seems okay.

> Does this affect other distributions?  In this case, it's best to
> request a CVE ID on the oss-security list.

I think this is already CVE-2016-7796.

There were two CVE assingments for systemd recently, CVE-2016-7795 and
CVE-2016-7796, and assigned here:
https://marc.info/?l=oss-security&m=147521835218986&w=2

CVE-2016-7795 is for

https://github.com/systemd/systemd/issues/4234
https://www.agwa.name/blog/post/how_to_crash_systemd_in_one_tweet

which does not affect stable.

CVE-2016-7796 is for

https://github.com/systemd/systemd/issues/4234#issuecomment-250441246
with fix https://github.com/systemd/systemd/pull/4240 which is this
bug #839607.

Does this look correct to you as well, Florian?

Regards,
Salvatore

Thread

Bug#839607: Robustify manager_dispatch_notify_fd() Michael Biebl <biebl@debian.org> - 2016-10-02 22:40 +0200
  Bug#839607: Robustify manager_dispatch_notify_fd() Michael Biebl <biebl@debian.org> - 2016-10-02 22:50 +0200
  Re: Robustify manager_dispatch_notify_fd() Wolfgang Karall <lists+debian-security@karall-edv.at> - 2016-10-03 08:30 +0200
    Re: Robustify manager_dispatch_notify_fd() Michael Biebl <biebl@debian.org> - 2016-10-03 12:20 +0200
      Bug#839607: Robustify manager_dispatch_notify_fd() Michael Biebl <biebl@debian.org> - 2016-10-03 12:40 +0200
      Bug#839607: Robustify manager_dispatch_notify_fd() Michael Biebl <biebl@debian.org> - 2016-10-03 12:50 +0200
        Bug#839607: Robustify manager_dispatch_notify_fd() Florian Weimer <fw@deneb.enyo.de> - 2016-10-03 13:00 +0200
          Bug#839607: Robustify manager_dispatch_notify_fd() Salvatore Bonaccorso <carnil@debian.org> - 2016-10-03 14:00 +0200
            Bug#839607: Robustify manager_dispatch_notify_fd() Florian Weimer <fw@deneb.enyo.de> - 2016-10-03 14:00 +0200
      Re: Robustify manager_dispatch_notify_fd() Wolfgang Karall <lists+debian-security@karall-edv.at> - 2016-10-03 14:40 +0200

csiph-web