CVE-2019-6454

An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).

This update for systemd fixes the following issues:

• CVE-2019-6454: Overlong DBUS messages could be used to crash systemd (bsc#1125352)

• units: make sure initrd-cleanup.service terminates before switching to rootfs (bsc#1123333)

• logind: fix bad error propagation

• login: log session state 'closing' (as well as New/Removed)

• logind: fix borked r check

• login: don't remove all devices from PID1 when only one was removed

• login: we only allow opening character devices

• login: correct comment in session_device_free()

• login: remember that fds received from PID1 need to be removed eventually

• login: fix FDNAME in call to sd_pid_notify_with_fds()

• logind: fd 0 is a valid fd

• logind: rework sd_eviocrevoke()

• logind: check file is device node before using .st_rdev

• logind: use the new FDSTOREREMOVE=1 sd_notify() message (bsc#1124153)

• core: add a new sd_notify() message for removing fds from the FD store again

• logind: make sure we don't trip up on half-initialized session devices (bsc#1123727)

• fd-util: accept that kcmp might fail with EPERM/EACCES

• core: Fix use after free case in load_from_path() (bsc#1121563)

• core: include Found state in device dumps

• device: fix serialization and deserialization of DeviceFound

• fix path in btrfs rule (#6844)

• assemble multidevice btrfs volumes without external tools (#6607) (bsc#1117025)

• Update systemd-system.conf.xml (bsc#1122000)

• units: inform user that the default target is started after exiting from rescue or emergency mode

• core: free lines after reading them (bsc#1123892)

• sd-bus: if we receive an invalid dbus message, ignore and proceeed

• automount: don't pass non-blocking pipe to kernel.

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the libsystemd0-249.4-2.2 package on the GA media of openSUSE Tumbleweed.

This update for systemd fixes the following issues:

Security vulnerability fixed:

• CVE-2019-6454: Fixed a crash of PID1 by sending specially crafted D-BUS message on the system bus by an unprivileged user (bsc#1125352)

This update for systemd fixes the following issues:

Security vulnerability fixed:

• CVE-2019-6454: Fixed a crash of PID1 by sending specially crafted D-BUS message on the system bus by an unprivileged user (bsc#1125352)

This update for systemd fixes the following issues:

Security vulnerability fixed:

• CVE-2019-6454: Fixed a crash of PID1 by sending specially crafted D-BUS message on the system bus by an unprivileged user (bsc#1125352)

This update for systemd fixes the following issues:

• CVE-2019-6454: Overlong DBUS messages could be used to crash systemd (bsc#1125352)

• units: make sure initrd-cleanup.service terminates before switching to rootfs (bsc#1123333)

• logind: fix bad error propagation

• login: log session state 'closing' (as well as New/Removed)

• logind: fix borked r check

• login: don't remove all devices from PID1 when only one was removed

• login: we only allow opening character devices

• login: correct comment in session_device_free()

• login: remember that fds received from PID1 need to be removed eventually

• login: fix FDNAME in call to sd_pid_notify_with_fds()

• logind: fd 0 is a valid fd

• logind: rework sd_eviocrevoke()

• logind: check file is device node before using .st_rdev

• logind: use the new FDSTOREREMOVE=1 sd_notify() message (bsc#1124153)

• core: add a new sd_notify() message for removing fds from the FD store again

• logind: make sure we don't trip up on half-initialized session devices (bsc#1123727)

• fd-util: accept that kcmp might fail with EPERM/EACCES

• core: Fix use after free case in load_from_path() (bsc#1121563)

• core: include Found state in device dumps

• device: fix serialization and deserialization of DeviceFound

• fix path in btrfs rule (#6844)

• assemble multidevice btrfs volumes without external tools (#6607) (bsc#1117025)

• Update systemd-system.conf.xml (bsc#1122000)

• units: inform user that the default target is started after exiting from rescue or emergency mode

• core: free lines after reading them (bsc#1123892)

• sd-bus: if we receive an invalid dbus message, ignore and proceeed

• automount: don't pass non-blocking pipe to kernel.

This update for systemd fixes the following issues:

Security vulnerability fixed:

• CVE-2019-6454: Fixed a crash of PID1 by sending specially crafted D-BUS message on the system bus by an unprivileged user (bsc#1125352)

Other bug fixes and changes:

• journal-remote: set a limit on the number of fields in a message
• journal-remote: verify entry length from header
• journald: set a limit on the number of fields (1k)
• journald: do not store the iovec entry for process commandline on stack
• core: include Found state in device dumps
• device: fix serialization and deserialization of DeviceFound
• fix path in btrfs rule (#6844)
• assemble multidevice btrfs volumes without external tools (#6607) (bsc#1117025)
• Update systemd-system.conf.xml (bsc#1122000)
• units: inform user that the default target is started after exiting from rescue or emergency mode
• manager: don't skip sigchld handler for main and control pid for services (#3738)
• core: Add helper functions unit_{main, control}_pid
• manager: Fixing a debug printf formatting mistake (#3640)
• manager: Only invoke a single sigchld per unit within a cleanup cycle (bsc#1117382)
• core: update invoke_sigchld_event() to handle NULL ->sigchld_event()
• sd-event: expose the event loop iteration counter via sd_event_get_iteration() (#3631)
• unit: rework a bit how we keep the service fdstore from being destroyed during service restart (bsc#1122344)
• core: when restarting services, don't close fds
• cryptsetup: Add dependency on loopback setup to generated units
• journal-gateway: use localStorage['cursor'] only when it has valid value
• journal-gateway: explicitly declare local variables
• analyze: actually select longest activated-time of services
• sd-bus: fix implicit downcast of bitfield reported by LGTM
• core: free lines after reading them (bsc#1123892)
• pam_systemd: reword message about not creating a session (bsc#1111498)
• pam_systemd: suppress LOG_DEBUG log messages if debugging is off (bsc#1111498)
• main: improve RLIMIT_NOFILE handling (#5795) (bsc#1120658)
• sd-bus: if we receive an invalid dbus message, ignore and proceeed
• automount: don't pass non-blocking pipe to kernel.
• units: make sure initrd-cleanup.service terminates before switching to rootfs (bsc#1123333)
• units: add Wants=initrd-cleanup.service to initrd-switch-root.target (#4345) (bsc#1123333)

This update for systemd fixes the following issues:

Security issues fixed:

• CVE-2018-6954: Fixed a vulnerability in the symlink handling of systemd-tmpfiles which allowed a local user to obtain ownership of arbitrary files (bsc#1080919).
• CVE-2019-3842: Fixed a vulnerability in pam_systemd which allowed a local user to escalate privileges (bsc#1132348).
• CVE-2019-6454: Fixed a denial of service caused by long dbus messages (bsc#1125352).

Non-security issues fixed:

• systemd-coredump: generate a stack trace of all core dumps (jsc#SLE-5933)
• udevd: notify when max number value of children is reached only once per batch of events (bsc#1132400)
• sd-bus: bump message queue size again (bsc#1132721)
• core: only watch processes when it's really necessary (bsc#955942 bsc#1128657)
• rules: load drivers only on 'add' events (bsc#1126056)
• sysctl: Don't pass null directive argument to '%s' (bsc#1121563)
• Do not automatically online memory on s390x (bsc#1127557)

This update for systemd fixes the following issues:

Security issues fixed:

• CVE-2019-3842: Fixed a privilege escalation in pam_systemd which could be exploited by a local user (bsc#1132348).
• CVE-2019-6454: Fixed a denial of service via crafted D-Bus message (bsc#1125352).
• CVE-2019-3843, CVE-2019-3844: Fixed a privilege escalation where services with DynamicUser could gain new privileges or create SUID/SGID binaries (bsc#1133506, bsc#1133509).

Non-security issued fixed:

• logind: fix killing of scopes (bsc#1125604)
• namespace: make MountFlags=shared work again (bsc#1124122)
• rules: load drivers only on 'add' events (bsc#1126056)
• sysctl: Don't pass null directive argument to '%s' (bsc#1121563)
• systemd-coredump: generate a stack trace of all core dumps and log into the journal (jsc#SLE-5933)
• udevd: notify when max number value of children is reached only once per batch of events (bsc#1132400)
• sd-bus: bump message queue size again (bsc#1132721)
• Do not automatically online memory on s390x (bsc#1127557)
• Removed sg.conf (bsc#1036463)

This update for systemd fixes the following issues:

Security issues fixed:

• CVE-2019-3842: Fixed a privilege escalation in pam_systemd which could be exploited by a local user (bsc#1132348).
• CVE-2019-6454: Fixed a denial of service via crafted D-Bus message (bsc#1125352).
• CVE-2019-3843, CVE-2019-3844: Fixed a privilege escalation where services with DynamicUser could gain new privileges or create SUID/SGID binaries (bsc#1133506, bsc#1133509).

Non-security issued fixed:

• logind: fix killing of scopes (bsc#1125604)
• namespace: make MountFlags=shared work again (bsc#1124122)
• rules: load drivers only on 'add' events (bsc#1126056)
• sysctl: Don't pass null directive argument to '%s' (bsc#1121563)
• systemd-coredump: generate a stack trace of all core dumps and log into the journal (jsc#SLE-5933)
• udevd: notify when max number value of children is reached only once per batch of events (bsc#1132400)
• sd-bus: bump message queue size again (bsc#1132721)
• Do not automatically online memory on s390x (bsc#1127557)
• Removed sg.conf (bsc#1036463)

It was discovered that systemd incorrectly handled certain D-Bus messages. A local unprivileged attacker could exploit this in order to crash the init process, resulting in a system denial-of-service (kernel panic).