Bug 799902 (CVE-2012-1101)

Summary:	CVE-2012-1101 systemd: Units that failed to load were not cleaned up leading to DoS
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	johannbg, metherid, notting, plautrba, systemd-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-03-05 11:52:26 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	680122
Bug Blocks:

Description Jan Lieskovsky 2012-03-05 11:42:18 UTC

A security flaw was found in the way systemd loaded configuration for non-existent service(s). A local user could use this flaw to create entry in systemd's service list for that service via 'systemctl status non-existent.service', potentially leading to denial of service (failure of login procedure) when the list of previously loaded units reached upper limit.

References:
[1] https://bugzilla.redhat.com/show_bug.cgi?id=680122
[2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=662029
[3] https://bugzilla.novell.com/show_bug.cgi?id=750397
[4] http://seclists.org/oss-sec/2012/q1/537

Upstream patch:
[5] http://cgit.freedesktop.org/systemd/systemd/commit/?id=9a46fc3b9014de1bf0ed1f3004a536b08a19ebb3

Comment 1 Jan Lieskovsky 2012-03-05 11:52:26 UTC

This issue did NOT affect the current versions (systemd-26-16.fc15 and systemd-37-13.fc16 respectively) of the systemd package, as being actually present within Fedora release of 15 and 16.