CVE-2022-3821

An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.

An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.

systemd is a system and service manager that runs as PID 1 and starts the rest of the system.

Security Fix(es):

An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.(CVE-2022-3821)

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es):

• systemd: buffer overrun in format_timespan() function (CVE-2022-3821)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es):

• systemd: buffer overrun in format_timespan() function (CVE-2022-3821)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• ShutdownWatchdogSec value is not taken into account on reboot (BZ#2127170)

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es):

• systemd: buffer overrun in format_timespan() function (CVE-2022-3821)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2022-3821: fix off-by-one buffer overflow in format_timespan()

• CVE-2022-3821: fix off-by-one buffer overflow in format_timespan()

• SECURITY UPDATE: buffer overrun vulnerability in format_timespan()
  • debian/patches/CVE-2022-3821.patch: fix buffer-over-run
  • CVE-2022-3821
• SECURITY UPDATE: a local privelege escalation for some sudo configs was not blocked adequately
  • debian/patches/CVE-2023-26604.patch: use only less as a pager and restrict its functionality (e.g stop running external shell) unless environment variable SYSTEMD_PAGERSECURE is defined
  • CVE-2023-26604

• CVE-2022-3821: fix buffer-over-run in format_timespan

• CVE-2022-3821: fix buffer-over-run in format_timespan

• CVE-2022-3821: fix buffer-over-run in format_timespan

buffer overrun in format_timespan() function (bsc#1204968) (CVE-2022-3821) Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428 0469b9f2bc pstore: do not try to load all known pstore modules ad05f54439 pstore: Run after modules are loaded ccad817445 core: Add trigger limit for path units 281d818fe3 core/mount: also add default before dependency for automount mount units ffe5b4afa8 logind: fix crash in logind on user-specified message string Document udev naming scheme (bsc#1204179) Make "sle15-sp3" net naming scheme still available for backward compatibility reason

These are all security issues fixed in the libsystemd0-254.5-3.1 package on the GA media of openSUSE Tumbleweed.

This update for systemd fixes the following issues:

• CVE-2022-3821: Fixed buffer overrun in format_timespan() function (bsc#1204968).

• Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428

  • 0469b9f2bc pstore: do not try to load all known pstore modules
  • ad05f54439 pstore: Run after modules are loaded
  • ccad817445 core: Add trigger limit for path units
  • 281d818fe3 core/mount: also add default before dependency for automount mount units
  • ffe5b4afa8 logind: fix crash in logind on user-specified message string

• Document udev naming scheme (bsc#1204179)

• Make 'sle15-sp3' net naming scheme still available for backward compatibility reason

This update for systemd fixes the following issues:

• CVE-2022-3821: Fixed buffer overrun in format_timespan() function (bsc#1204968).

• Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2

  • 8a70235d8a core: Add trigger limit for path units
  • 93e544f3a0 core/mount: also add default before dependency for automount mount units
  • 5916a7748c logind: fix crash in logind on user-specified message string

• Document udev naming scheme (bsc#1204179).

This update for systemd fixes the following issues:

• CVE-2022-3821: Fixed buffer overrun in format_timespan() function (bsc#1204968).

• Import commit 417bb0944e035969594fff83a3ab9c2ca9a56234

  • 20743c1a44 logind: fix crash in logind on user-specified message string
  • b971b5f085 tmpfiles: check the directory we were supposed to create, not its parent
  • 2850271ea6 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  • 3d3bd5fc8d systemd --user: call pam_loginuid when creating [email protected] (#3120) (bsc#1198507)
  • 4b56c3540a parse-util: introduce pid_is_valid()
  • aa811a4c0c systemd-detect-virt: refine hypervisor detection (#7171) (bsc#1197244)

This update for systemd fixes the following issues:

• CVE-2023-26604: Fixed a privilege escalation via the less pager. (bsc#1208958)
• CVE-2022-4415: Fixed systemd-coredump that did not respect the fs.suid_dumpable kernel setting (bsc#1205000).
• CVE-2022-3821: Fixed buffer overrun in format_timespan() function (bsc#1204968).

Bug fixes:

• Restrict cpu rule to x86_64, and also update the rule files to make use of the 'CONST{arch}' syntax (bsc#1204423).
• Fixed 'systemd --user' call pam_loginuid when creating [email protected] (bsc#1198507).
• Fixed 'systemd-detect-virt' refine hypervisor detection (bsc#1197244).
• Fixed 'udev' 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529).
• Fixed 'man' tweak description of auto/noauto (bsc#1191502).

This update for systemd fixes the following issues:

• Import commit 0512d0d1fc0b54a84964281708036a46ab39c153 0512d0d1fc cgroup: Rename effective limits internal table (jsc#PED-5659) 765846b70b cgroup: Restrict effective limits with global resource provision (jsc#PED-5659) e29909088b test: Add effective cgroup limits testing (jsc#PED-5659) beacac6df0 test: Convert rlimit test to subtest of generic limit testing (jsc#PED-5659) e3b789e512 cgroup: Add EffectiveMemoryMax=, EffectiveMemoryHigh= and EffectiveTasksMax= properties (jsc#PED-5659) 5aa063ae16 bus-print-properties: prettify more unset properties a53122c9bd bus-print-properties: ignore CGROUP_LIMIT_MAX for Memory*{Current, Peak} 8418791441 cgroup: rename TasksMax structure to CGroupTasksMax

• Don't try to restart the udev socket units anymore (bsc#1228809)

  There's currently no way to restart a socket activable service and its socket units "atomically" and safely.

• Make the 32bit version of libudev.so available again (bsc#1228223)

  The symlink for building 32bit applications was mistakenly dropped when the content of libudev-devel was merged into systemd-devel.

  Provide the 32bit flavor of systemd-devel again, which should restore the plug and play support in Wine for 32bit windows applications.

• Import commit up to 5aa182660dff86fe9d5cba61b0c6542bb2f2db23 (merge of v254.17)

It was discovered that systemd did not properly validate the time and accuracy values provided to the format_timespan() function. An attacker could possibly use this issue to cause a buffer overrun, leading to a denial of service attack. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-3821)

It was discovered that systemd did not properly manage the fs.suid_dumpable kernel configurations. A local attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-4415)

It was discovered that systemd did not properly manage a crash with long backtrace data. A local attacker could possibly use this issue to cause a deadlock, leading to a denial of service attack. This issue only affected Ubuntu 22.10. (CVE-2022-45873)