Bug 1639071 (CVE-2018-15686)
| Summary: | CVE-2018-15686 systemd: line splitting via fgets() allows for state injection during daemon-reexec | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Sam Fowler <sfowler> | ||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||
| Status: | CLOSED ERRATA | QA Contact: | |||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | unspecified | CC: | abhgupta, dbaker, jokerman, lnykryn, lpoetter, maling423, mmezynsk, msekleta, nupur.priya, rschiron, security-response-team, slawomir, s, sthangav, systemd-maint-list, systemd-maint, trankin, tvainio, zbyszek, zjedrzej | ||||
| Target Milestone: | --- | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
| Doc Text: |
It was discovered that systemd is vulnerable to a state injection attack when deserializing the state of a service. Properties longer than LINE_MAX are not correctly parsed and an attacker may abuse this flaw in particularly configured services to inject, change, or corrupt the service state.
|
Story Points: | --- | ||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2019-08-06 19:19:53 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 1641566, 1643372, 1643373, 1756862, 1756863, 1756864, 1786125, 1786126 | ||||||
| Bug Blocks: | 1639072 | ||||||
| Attachments: |
|
||||||
|
Description
Sam Fowler
2018-10-15 02:12:59 UTC
When systemd re-executes, the state is serialized and then deserialized after the re-execution. Function unit_deserialize() in file unit.c does not properly handle lines longer than LINE_MAX and the content of a property longer than that is parsed as part of the serialized state, allowing an attacker to corrupt the state of the service (e.g. change the main-pid, control-pid, etc.) Systemd services with `NotifyAccess != none` can send a status message to systemd, which stores it in the `status-text` property and, in turn, it may trigger the vulnerability. However, this may not be the only way to exploit this flaw. Any other way to set a serialized property to a value longer than LINE_MAX may trigger the flaw as well. Patch currently under review at: https://github.com/systemd/systemd/pull/10519 Created systemd tracking bugs for this issue: Affects: fedora-all [bug 1643372] Acknowledgments: Name: Ubuntu, Jann Horn (Google Project Zero) By when shall we expect the official release?? This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2091 https://access.redhat.com/errata/RHSA-2019:2091 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2018-15686 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.6 Extended Update Support Via RHSA-2019:3222 https://access.redhat.com/errata/RHSA-2019:3222 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.4 Advanced Update Support Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions Red Hat Enterprise Linux 7.4 Telco Extended Update Support Via RHSA-2020:0593 https://access.redhat.com/errata/RHSA-2020:0593 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.5 Extended Update Support Via RHSA-2020:1264 https://access.redhat.com/errata/RHSA-2020:1264 Created attachment 1681334 [details]
patch
|