Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5029 > unrolled thread

Bug#839607: Robustify manager_dispatch_notify_fd()

Back to article view | Back to linux.debian.security

Contents

  Bug#839607: Robustify manager_dispatch_notify_fd() Michael Biebl <biebl@debian.org> - 2016-10-02 22:40 +0200
    Bug#839607: Robustify manager_dispatch_notify_fd() Michael Biebl <biebl@debian.org> - 2016-10-02 22:50 +0200
    Re: Robustify manager_dispatch_notify_fd() Wolfgang Karall <lists+debian-security@karall-edv.at> - 2016-10-03 08:30 +0200
      Re: Robustify manager_dispatch_notify_fd() Michael Biebl <biebl@debian.org> - 2016-10-03 12:20 +0200
        Bug#839607: Robustify manager_dispatch_notify_fd() Michael Biebl <biebl@debian.org> - 2016-10-03 12:40 +0200
        Bug#839607: Robustify manager_dispatch_notify_fd() Michael Biebl <biebl@debian.org> - 2016-10-03 12:50 +0200
          Bug#839607: Robustify manager_dispatch_notify_fd() Florian Weimer <fw@deneb.enyo.de> - 2016-10-03 13:00 +0200
            Bug#839607: Robustify manager_dispatch_notify_fd() Salvatore Bonaccorso <carnil@debian.org> - 2016-10-03 14:00 +0200
              Bug#839607: Robustify manager_dispatch_notify_fd() Florian Weimer <fw@deneb.enyo.de> - 2016-10-03 14:00 +0200
        Re: Robustify manager_dispatch_notify_fd() Wolfgang Karall <lists+debian-security@karall-edv.at> - 2016-10-03 14:40 +0200

#5029 — Bug#839607: Robustify manager_dispatch_notify_fd()

Package: systemd
Version: 215-17+deb8u5
Severity: important
User: pkg-systemd-maintainers@lists.alioth.debian.org
Usertags: jessie-backport

The news about systemd crashing when getting a zero sized message on the
notification socket made the rounds recently.
While v215 is not directly affected by this crash (the code to access
messages of length=0 was added in v21), the version in unstable still
get's confused when it receives such a message and basically disables
the notification system. This is bad, because services relying on the
notification system, e.g. using the watchdog functionality, are getting
killed.

The relevant upstream issue is
https://github.com/systemd/systemd/pull/4240

231-9 in unstable already contains this fix.

I would propose to fix this in stable via regular stable update but
would appreciate if the debian-security team would comment on this.
If they would prefer a security upload I'm happy to do that as well.


Regards,
Michael



-- Package-specific info:

-- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (200, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.7.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages systemd depends on:
ii  adduser         3.115
ii  libacl1         2.2.52-3
ii  libapparmor1    2.10.95-4+b1
ii  libaudit1       1:2.6.7-1
ii  libblkid1       2.28.2-1
ii  libc6           2.24-3
ii  libcap2         1:2.25-1
ii  libcryptsetup4  2:1.7.0-2
ii  libgcrypt20     1.7.3-1
ii  libgpg-error0   1.24-1
ii  libidn11        1.33-1
ii  libip4tc0       1.6.0-3
ii  libkmod2        22-1.1
ii  liblzma5        5.1.1alpha+20120614-2.1
ii  libmount1       2.28.2-1
ii  libpam0g        1.1.8-3.3
ii  libseccomp2     2.3.1-2
ii  libselinux1     2.5-3
ii  libsystemd0     231-9
ii  mount           2.28.2-1
ii  util-linux      2.28.2-1

Versions of packages systemd recommends:
ii  dbus            1.10.10-1
ii  libpam-systemd  231-9

Versions of packages systemd suggests:
ii  policykit-1        0.105-16
ii  systemd-container  231-9
pn  systemd-ui         <none>

Versions of packages systemd is related to:
ii  udev  231-9

-- no debconf information

[toc] | [next] | [standalone]

#5030

[Multipart message — attachments visible in raw view] — view raw

Control: fixed -1 231-9

Am 02.10.2016 um 22:36 schrieb Michael Biebl:
> Package: systemd
> Version: 215-17+deb8u5
> Severity: important
> User: pkg-systemd-maintainers@lists.alioth.debian.org
> Usertags: jessie-backport
> 
> The news about systemd crashing when getting a zero sized message on the
> notification socket made the rounds recently.
> While v215 is not directly affected by this crash (the code to access
> messages of length=0 was added in v21), the version in unstable still

was added in v219, not v21

> get's confused when it receives such a message and basically disables
> the notification system. This is bad, because services relying on the
> notification system, e.g. using the watchdog functionality, are getting
> killed.
> 
> The relevant upstream issue is
> https://github.com/systemd/systemd/pull/4240
> 
> 231-9 in unstable already contains this fix.

Marking accordingly

-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

[toc] | [prev] | [next] | [standalone]

#5031 — Re: Robustify manager_dispatch_notify_fd()

[Multipart message — attachments visible in raw view] — view raw

Hello Michael,

On 16-10-02 22:36:00, Michael Biebl wrote:
> The news about systemd crashing when getting a zero sized message
> on the notification socket made the rounds recently.  While v215 is
> not directly affected by this crash (the code to access messages of
> length=0 was added in v219)
[..]
> I would propose to fix this in stable via regular stable update but
> would appreciate if the debian-security team would comment on this.
> If they would prefer a security upload I'm happy to do that as well.

https://security-tracker.debian.org/tracker/CVE-2016-7796 says all but
the version in sid are vulnerable to CVE-2016-7796 and reading

https://github.com/systemd/systemd/issues/4234#issuecomment-250441246

this sounds still rather serious, so a security upload would be
appreciated.

Cheers
Wolfgang

[toc] | [prev] | [next] | [standalone]

#5032 — Re: Robustify manager_dispatch_notify_fd()

[Multipart message — attachments visible in raw view] — view raw

Am 03.10.2016 um 08:22 schrieb Wolfgang Karall:
> Hello Michael,
> 
> On 16-10-02 22:36:00, Michael Biebl wrote:
>> The news about systemd crashing when getting a zero sized message
>> on the notification socket made the rounds recently.  While v215 is
>> not directly affected by this crash (the code to access messages of
>> length=0 was added in v219)
> [..]
>> I would propose to fix this in stable via regular stable update but
>> would appreciate if the debian-security team would comment on this.
>> If they would prefer a security upload I'm happy to do that as well.
> 
> https://security-tracker.debian.org/tracker/CVE-2016-7796 says all but
> the version in sid are vulnerable to CVE-2016-7796 and reading

No, sid is not vulnerable. It has been fixed in 231-9

> https://github.com/systemd/systemd/issues/4234#issuecomment-250441246
> 
> this sounds still rather serious, so a security upload would be
> appreciated.
> 

This bugs is *not* about CVE-2016-7796 and as I wrote, stable is not
affected by the crash.

Are you a member of the security team? I've never seen your name before
so I'm a bit confused as I explicitly asked from input from the security
team.


-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

[toc] | [prev] | [next] | [standalone]

#5033

[Multipart message — attachments visible in raw view] — view raw

Am 03.10.2016 um 12:11 schrieb Michael Biebl:
> Am 03.10.2016 um 08:22 schrieb Wolfgang Karall:
>> Hello Michael,
>>
>> On 16-10-02 22:36:00, Michael Biebl wrote:
>>> The news about systemd crashing when getting a zero sized message
>>> on the notification socket made the rounds recently.  While v215 is
>>> not directly affected by this crash (the code to access messages of
>>> length=0 was added in v219)
>> [..]
>>> I would propose to fix this in stable via regular stable update but
>>> would appreciate if the debian-security team would comment on this.
>>> If they would prefer a security upload I'm happy to do that as well.
>>
>> https://security-tracker.debian.org/tracker/CVE-2016-7796 says all but
>> the version in sid are vulnerable to CVE-2016-7796 and reading
> 
> No, sid is not vulnerable. It has been fixed in 231-9
> 
>> https://github.com/systemd/systemd/issues/4234#issuecomment-250441246
>>
>> this sounds still rather serious, so a security upload would be
>> appreciated.
>>

Fwiw, we discussed this issue briefly within the pkg-systemd team. While
a local DoS, which we consider the issue in stable to be, is not great,
it's not like local users can't DoS the system via other means just as
easily, like say fork bombs.

Why would you consider this particular issue to be "rather serious"?


-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

[toc] | [prev] | [next] | [standalone]

#5034

[Multipart message — attachments visible in raw view] — view raw

Am 03.10.2016 um 12:11 schrieb Michael Biebl:
> Am 03.10.2016 um 08:22 schrieb Wolfgang Karall:
>> Hello Michael,
>>
>> On 16-10-02 22:36:00, Michael Biebl wrote:
>>> The news about systemd crashing when getting a zero sized message
>>> on the notification socket made the rounds recently.  While v215 is
>>> not directly affected by this crash (the code to access messages of
>>> length=0 was added in v219)
>> [..]
>>> I would propose to fix this in stable via regular stable update but
>>> would appreciate if the debian-security team would comment on this.
>>> If they would prefer a security upload I'm happy to do that as well.
>>
>> https://security-tracker.debian.org/tracker/CVE-2016-7796 says all but
>> the version in sid are vulnerable to CVE-2016-7796 and reading
> 
> No, sid is not vulnerable. It has been fixed in 231-9
> 
>> https://github.com/systemd/systemd/issues/4234#issuecomment-250441246
>>
>> this sounds still rather serious, so a security upload would be
>> appreciated.
>>
> 
> This bugs is *not* about CVE-2016-7796 and as I wrote, stable is not
> affected by the crash.
> 
> Are you a member of the security team? I've never seen your name before
> so I'm a bit confused as I explicitly asked from input from the security
> team.

It was pointed out that I used the wrong list and that
debian-security@l.d.o is not actually the correct list to contact the
debian security team. So apologies for that.

I've added team@security.debian.org now and will drop
debian-security@lists.debian.org on further replies.

Dear security team, I'd appreciate your input on bug #839607

-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

[toc] | [prev] | [next] | [standalone]

#5035

* Michael Biebl:

> Dear security team, I'd appreciate your input on bug #839607

It's a bug, and it should be fixed in stable, probably in a point
update.

Does this affect other distributions?  In this case, it's best to
request a CVE ID on the oss-security list.

[toc] | [prev] | [next] | [standalone]

#5036

Hi,

On Mon, Oct 03, 2016 at 12:48:15PM +0200, Florian Weimer wrote:
> * Michael Biebl:
> 
> > Dear security team, I'd appreciate your input on bug #839607
> 
> It's a bug, and it should be fixed in stable, probably in a point
> update.

Agreed, and fixing via point release seems okay.

> Does this affect other distributions?  In this case, it's best to
> request a CVE ID on the oss-security list.

I think this is already CVE-2016-7796.

There were two CVE assingments for systemd recently, CVE-2016-7795 and
CVE-2016-7796, and assigned here:
https://marc.info/?l=oss-security&m=147521835218986&w=2

CVE-2016-7795 is for

https://github.com/systemd/systemd/issues/4234
https://www.agwa.name/blog/post/how_to_crash_systemd_in_one_tweet

which does not affect stable.

CVE-2016-7796 is for

https://github.com/systemd/systemd/issues/4234#issuecomment-250441246
with fix https://github.com/systemd/systemd/pull/4240 which is this
bug #839607.

Does this look correct to you as well, Florian?

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#5037

* Salvatore Bonaccorso:

> There were two CVE assingments for systemd recently, CVE-2016-7795 and
> CVE-2016-7796, and assigned here:
> https://marc.info/?l=oss-security&m=147521835218986&w=2
>
> CVE-2016-7795 is for
>
> https://github.com/systemd/systemd/issues/4234
> https://www.agwa.name/blog/post/how_to_crash_systemd_in_one_tweet
>
> which does not affect stable.
>
> CVE-2016-7796 is for
>
> https://github.com/systemd/systemd/issues/4234#issuecomment-250441246
> with fix https://github.com/systemd/systemd/pull/4240 which is this
> bug #839607.
>
> Does this look correct to you as well, Florian?

Based on <https://marc.info/?l=oss-security&m=147521835218986&w=2>,
I agree.

[toc] | [prev] | [next] | [standalone]

#5038 — Re: Robustify manager_dispatch_notify_fd()

[Multipart message — attachments visible in raw view] — view raw

Hello Michael,

On 16-10-03 12:11:48, Michael Biebl wrote:
> > https://security-tracker.debian.org/tracker/CVE-2016-7796 says all
> > but the version in sid are vulnerable to CVE-2016-7796 and reading
>
> No, sid is not vulnerable. It has been fixed in 231-9

I wrote 'all but the version in sid', English not being my mother tongue
this seemed to me the correct way to express exactly that, i.e. 'sid is
not vulnerable', but maybe I'm wrong.

> > https://github.com/systemd/systemd/issues/4234#issuecomment-250441246
> > 
> > this sounds still rather serious, so a security upload would be
> > appreciated.
> > 
> 
> This bugs is *not* about CVE-2016-7796 and as I wrote, stable is not
> affected by the crash.

You didn't write about which CVE the bug is (or maybe I missed that),
just that the 'news about systemd crashing when getting a zero sized
message on the notification socket made the rounds recently'.

> Are you a member of the security team?

No, I never said I am, but it seems you noticed your error or were
pointed to it.

And thanks to Florian and Salvatore for reading the same information
that I did and taking this seriously in a polite manner.

Cheers
Wolfgang

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web