Bug 1381911 (CVE-2016-7796)

Summary:	CVE-2016-7796 systemd: freeze when PID 1 receives a zero-length message over notify socket
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	johannbg, lnykryn, msekleta, muadda, slawomir, ssahani, s, systemd-maint-list, systemd-maint, tbowling, ykawada, zbyszek
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the way systemd handled empty notification messages. A local attacker could use this flaw to make systemd freeze its execution, preventing further management of system services, system shutdown, or zombie process collection via systemd.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-10-05 12:06:39 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1393420
Bug Blocks:	1380288

Description Tomas Hoger 2016-10-05 11:07:21 UTC

It was found that systemd fails an assertion in manager_invoke_notify_message() when a zero-length message is received over its notification socket, causing it to no longer perform it's expected functionality.  This issue was assigned CVE-2016-7795 and is tracked via bug 1380286.  Upstream bug report is:

https://github.com/systemd/systemd/issues/4234

Older systemd versions either don't include the assert that is triggered in manager_invoke_notify_message(), or have manager_process_notify_fd() function return error before calling manager_invoke_notify_message().  That error return still causes systemd to exit its main loop and freeze its execution in a similar way it's done in newer versions after failed assertion.

https://github.com/systemd/systemd/issues/4234#issuecomment-250441246

The manager_invoke_notify_message() function with assert was introduced in version v209:

https://github.com/systemd/systemd/commit/5ba6985b6c8ef85a8bcfeb1b65239c863436e75b#diff-ab78220e12703ee63fa1e6a2caa16bebR1319

However, the assertion was not reachable before the error return was removed in v219:

https://github.com/systemd/systemd/commit/d875aa8ce10b458dc218c0d98f4a82c8904d6d03

The systemd versions in Red Hat Enterprise Linux 7.0 and 7.1 are based on upstream v208, but include manager_invoke_notify_message() added via a separate backported patch.  The assertion is not reachable, so those versions are affected by CVE-2016-7796, but not affected by CVE-2016-7795.  Red Hat Enterprise Linux 7.2 rebased systemd to version v219.  Therefore, those packages are no longer affected by CVE-2016-7796, but are now affected by CVE-2016-7795.

Comment 1 Tomas Hoger 2016-10-05 12:06:39 UTC

As noted in the previous comment, this issue was fixed when systemd packages were rebased to version v219 as part of the Red Hat Enterprise Linux 7.2:

https://rhn.redhat.com/errata/RHBA-2015-2092.html

Comment 2 errata-xmlrpc 2017-01-03 16:56:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.1 Extended Update Support

Via RHSA-2017:0003 https://rhn.redhat.com/errata/RHSA-2017-0003.html