CVE-2021-33910

systemd is a system and service manager that runs as PID 1 and starts the rest of the system.

Security Fix(es):

basic/unit-name.c in systemd 220 through 248 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.(CVE-2021-33910)

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es):

• systemd: uncontrolled allocation on the stack in function unit_name_path_escape leads to crash (CVE-2021-33910)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.

• SECURITY UPDATE: crash in systemd leading to a kernel panic
  • debian/patches/CVE-2021-33910.patch: use strdup instead of strdupa to avoid stack memory exhaustion.
  • CVE-2021-33910

This systemd update provides the v246.15 maintenance release and fixes at least the following security issues:

An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server (CVE-2020-13529).

basic/unit-name.c in systemd 220 through 248 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash (CVE-2021-29270).

This update for systemd fixes the following issues:

• CVE-2021-33910: Fixed a denial of service in systemd via unit_name_path_escape() (bsc#1188063)
• Skip udev rules if 'elevator=' is used (bsc#1184994)

This update was imported from the SUSE:SLE-15:Update update project.

This update for systemd fixes the following issues:

• CVE-2021-33910: Fixed use of strdupa() on a path (bsc#1188063).

• logind: terminate cleanly on SIGTERM/SIGINT (bsc#1188018).

• Adopting BFQ to control I/O (jsc#SLE-21032, bsc#1134353).

• Rules weren't applied to dm devices (multipath) (bsc#1188713).

• Ignore obsolete 'elevator' kernel parameter (bsc#1184994, bsc#1190234).

• Make sure the versions of both udev and systemd packages are always the same (bsc#1189480).

• Avoid error message when udev is updated due to udev being already active when the sockets are started again (bsc#1188291).

• Allow the systemd sysusers config files to be overriden during system installation (bsc#1171962).

This update was imported from the SUSE:SLE-15:Update update project.

This update for systemd fixes the following issues:

• CVE-2021-33910: Fixed a denial of service in systemd via unit_name_path_escape() (bsc#1188063)
• Skip udev rules if 'elevator=' is used (bsc#1184994)

This update for systemd fixes the following issues:

• CVE-2021-33910: Fixed a denial of service (stack exhaustion) in systemd (PID 1) (bsc#1188063)

This update for systemd fixes the following issues:

• Updated to version 246.15
• CVE-2021-33910: Fixed a denial of service issue in systemd. (bsc#1188063)
• CVE-2020-13529: Fixed an issue that allows crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. (bsc#1185972)

This update for systemd fixes the following issues:

• CVE-2021-33910: Fixed use of strdupa() on a path (bsc#1188063).

• logind: terminate cleanly on SIGTERM/SIGINT (bsc#1188018).

• Adopting BFQ to control I/O (jsc#SLE-21032, bsc#1134353).

• Rules weren't applied to dm devices (multipath) (bsc#1188713).

• Ignore obsolete 'elevator' kernel parameter (bsc#1184994, bsc#1190234).

• Make sure the versions of both udev and systemd packages are always the same (bsc#1189480).

• Avoid error message when udev is updated due to udev being already active when the sockets are started again (bsc#1188291).

• Allow the systemd sysusers config files to be overriden during system installation (bsc#1171962).

These are all security issues fixed in the libsystemd0-249.4-2.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kubernetes1.22-apiserver-1.22.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for systemd fixes the following issues:

• CVE-2021-33910: Fixed a denial of service in systemd via unit_name_path_escape() (bsc#1188063)
• Skip udev rules if 'elevator=' is used (bsc#1184994)

This update for systemd fixes the following issues:

• CVE-2021-33910: Fixed a denial of service in systemd via unit_name_path_escape() (bsc#1188063)
• Fixed a regression with hostnamectl and timedatectl (bsc#1184761)
• Fixed permissions for /usr/lib/udev/compat-symlink-generation (bsc#1185807)

This update for systemd fixes the following issues:

• CVE-2021-33910: Fixed a denial of service (stack exhaustion) in systemd (PID 1) (bsc#1188063)

This update for systemd fixes the following issues:

Security issues fixed:

• CVE-2021-33910: Fixed a denial of service (stack exhaustion) in systemd (PID 1) (bsc#1188063)

Other fixes:

• mount-util: shorten the loop a bit (#7545)
• mount-util: do not use the official MAX_HANDLE_SZ (#7523)
• mount-util: tape over name_to_handle_at() flakiness (#7517) (bsc#1184761)
• mount-util: fix bad indenting
• mount-util: EOVERFLOW might have other causes than buffer size issues
• mount-util: fix error propagation in fd_fdinfo_mnt_id()
• mount-util: drop exponential buffer growing in name_to_handle_at_loop()
• udev: port udev_has_devtmpfs() to use path_get_mnt_id()
• mount-util: add new path_get_mnt_id() call that queries the mnt ID of a path
• mount-util: add name_to_handle_at_loop() wrapper around name_to_handle_at()
• mount-util: accept that name_to_handle_at() might fail with EPERM (#5499)
• basic: fallback to the fstat if we don't have access to the /proc/self/fdinfo
• sysusers: use the usual comment style
• test/TEST-21-SYSUSERS: add tests for new functionality
• sysusers: allow admin/runtime overrides to command-line config
• basic/strv: add function to insert items at position
• sysusers: allow the shell to be specified
• sysusers: move various user credential validity checks to src/basic/
• man: reformat table in sysusers.d(5)
• sysusers: take configuration as positional arguments
• sysusers: emit a bit more info at debug level when locking fails
• sysusers: allow force reusing existing user/group IDs (#8037)
• sysusers: ensure GID in uid:gid syntax exists
• sysusers: make ADD_GROUP always create a group
• test: add TEST-21-SYSUSERS test
• sysuser: use OrderedHashmap
• sysusers: allow uid:gid in sysusers.conf files
• sysusers: fix memleak (#4430)
• These commits implement the option '--replace' for systemd-sysusers so %sysusers_create_package can be introduced in SLE and packages can rely on this rpm macro without wondering whether the macro is available on the different target the package is submitted to.
• Expect 644 permissions for /usr/lib/udev/compat-symlink-generation (bsc#1185807)
• systemctl: add --value option
• execute: make sure to call into PAM after initializing resource limits (bsc#1184967)
• rlimit-util: introduce setrlimit_closest_all()
• system-conf: drop reference to ShutdownWatchdogUsec=
• core: rename ShutdownWatchdogSec to RebootWatchdogSec (bsc#1185331)
• Return -EAGAIN instead of -EALREADY from unit_reload (bsc#1185046)
• rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
• write_net_rules: set execute bits (bsc#1178561)
• udev: rework network device renaming
• Revert 'Revert 'udev: network device renaming - immediately give up if the target name isn't available''

This update for systemd fixes the following issues:

• Updated to version 246.15
• CVE-2021-33910: Fixed a denial of service issue in systemd. (bsc#1188063)
• CVE-2020-13529: Fixed an issue that allows crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. (bsc#1185972)

This update for systemd fixes the following issues:

• CVE-2021-33910: Fixed use of strdupa() on a path (bsc#1188063).

• logind: terminate cleanly on SIGTERM/SIGINT (bsc#1188018).

• Adopting BFQ to control I/O (jsc#SLE-21032, bsc#1134353).

• Rules weren't applied to dm devices (multipath) (bsc#1188713).

• Ignore obsolete 'elevator' kernel parameter (bsc#1184994, bsc#1190234).

• Make sure the versions of both udev and systemd packages are always the same (bsc#1189480).

• Avoid error message when udev is updated due to udev being already active when the sockets are started again (bsc#1188291).

• Allow the systemd sysusers config files to be overriden during system installation (bsc#1171962).

This update for systemd fixes the following issues:

• machine-id-setup: generate machine-id from DMI product ID on Amazon EC2
• Add timestamp to D-Bus events to improve traceability. (jsc#SLE-21894)
• busctl: add a timestamp to the output of the busctl monitor command (bsc#1180225, jsc#SLE-21894)
• sysctl: configure kernel parameters in the order they occur in each sysctl configuration files (bsc#1191399)
• basic/unit-name: do not use strdupa() on a path (bsc#1188063, CVE-2021-33910)
• logind: terminate cleanly on SIGTERM/SIGINT (bsc#1188018)
• units: make fsck/grows/makefs/makeswap units conflict against shutdown.target
• Make sure the versions of both udev and systemd packages are always the same (bsc#1189480)
• Avoid the error message when udev is updated due to udev being already active when the sockets are started again (bsc#1188291)
• Allow systemd sysusers config files to be overriden during system installation (bsc#1171962)

It was discovered that systemd incorrectly handled certain mount paths. A local attacker could possibly use this issue to cause systemd to crash, resulting in a denial of service. (CVE-2021-33910)

Mitchell Frank discovered that systemd incorrectly handled DHCP FORCERENEW packets. A remote attacker could possibly use this issue to reconfigure servers. (CVE-2020-13529)

USN-5013-1 fixed several vulnerabilities in systemd. This update provides the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that systemd incorrectly handled certain mount paths. A local attacker could possibly use this issue to cause systemd to crash, resulting in a denial of service. (CVE-2021-33910)

Mitchell Frank discovered that systemd incorrectly handled DHCP FORCERENEW packets. A remote attacker could possibly use this issue to reconfigure servers. (CVE-2020-13529)