Bug 2149063 (CVE-2022-45873)

Summary:	CVE-2022-45873 systemd: deadlock in systemd-coredump via a crash with a long backtrace
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abrianik, acrosby, adudiak, aoconnor, bdettelb, bgalvani, caswilli, dffrench, dhalasz, dkuc, fjansen, gzaronik, hbraun, hkataria, jburrell, jkoehler, jmitchel, jtanner, jwon, kaycoth, kshier, lnykryn, lrintel, micjohns, msekleta, ngough, nm-team, psegedy, rbobbitt, rgodfrey, rkhan, stcannon, sthirugn, sukulkar, systemd-maint-list, systemd-maint, tcarlin, tfister, till, tmeszaro, tsasak, vkrizan, vkumar, vmugicag, yguenane, zjedrzej
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	systemd 252-rc3	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the systemd-coredump utility of systemd. When an application crashes, the systemd-coredump utility is called twice, once by the kernel and the second time in the systemd-coredump@.service to write the data, process, and save the core file. Communication between the programs is made through a pipe, and when there is too much data through a long backtrace or many linked libraries, the pipe blocks while waiting for the data, resulting in a timeout of the systemd-coredump@.service.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-03-08 23:54:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2149066, 2149072, 2149073, 2149074, 2149075, 2149100
Bug Blocks:	2147551

Description Guilherme de Almeida Suckevicz 2022-11-28 17:53:46 UTC

systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology is to crash a binary calling the same function recursively, and put it in a deeply nested directory to make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16 is set for the systemd/units/systemd-coredump.socket file.

References:
https://github.com/systemd/systemd/pull/25055#issuecomment-1313733553

Upstream patch:
https://github.com/systemd/systemd/commit/076b807be472630692c5348c60d0c2b7b28ad437

Comment 1 Guilherme de Almeida Suckevicz 2022-11-28 18:06:51 UTC

Created systemd tracking bugs for this issue:

Affects: fedora-all [bug 2149066]

Comment 7 errata-xmlrpc 2023-02-28 08:18:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:0954 https://access.redhat.com/errata/RHSA-2023:0954

Comment 9 Product Security DevOps Team 2023-03-08 23:54:38 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-45873