For a follow-up xenial -security update we need: https://github.com/systemd/systemd/commit/8523bf7dd5 https://github.com/systemd/systemd/commit/9987750e7
which I just cherry-picked into the Debian packaging tree (for yakkety too): https://anonscm.debian.org/cgit/pkg-systemd/systemd.git/commit/?id=64196d509b https://anonscm.debian.org/cgit/pkg-systemd/systemd.git/commit/?id=c172afdd2 ** Changed in: systemd (Ubuntu Yakkety) Status: In Progress => Fix Committed ** Changed in: systemd (Ubuntu Yakkety) Assignee: (unassigned) => Martin Pitt (pitti) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to systemd in Ubuntu. https://bugs.launchpad.net/bugs/1628687 Title: Assertion failure when PID 1 receives a zero-length message over notify socket Status in systemd: New Status in systemd package in Ubuntu: Fix Committed Status in systemd source package in Xenial: In Progress Status in systemd source package in Yakkety: Fix Committed Bug description: Environment: Xenial 16.04.1 Amd64 Description. Systemd fails an assertion in manager_invoke_notify_message when a zero-length message is received over /run/systemd/notify. This allows a local user to perform a denial-of-service attack against PID 1. How to trigger the bug: $ while true; do NOTIFY_SOCKET=/run/systemd/notify systemd-notify ""; done The following entries are written into /var/log/syslog, at this point systemd is crashed. Sep 28 20:57:20 ubuntu systemd[1]: Started User Manager for UID 1000. Sep 28 20:57:28 ubuntu systemd[1]: Assertion 'n > 0' failed at ../src/core/manager.c:1501, function manager_invoke_notify_message(). Aborting. Sep 28 20:57:29 ubuntu systemd[1]: Caught <ABRT>, dumped core as pid 1307. Sep 28 20:57:29 ubuntu systemd[1]: Freezing execution. Public bug: https://github.com/systemd/systemd/issues/4234 To manage notifications about this bug go to: https://bugs.launchpad.net/systemd/+bug/1628687/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
