http://www.openwall.com/lists/oss-security/2013/10/01/5 "Date: Tue, 01 Oct 2013 12:56:23 +0530 From: Huzaifa Sidhpurwala <huzaifas@...hat.com> To: oss-security@...ts.openwall.com Subject: [CVE request] systemd Hi All, I would like to request CVE ids for 4 systemd issues. 1. systemd: Integer overflow, leading to heap-based buffer overflow by processing native messages https://bugzilla.redhat.com/show_bug.cgi?id=859051 2. systemd: TOCTOU race condition when updating file permissions and SELinux security contexts https://bugzilla.redhat.com/show_bug.cgi?id=859060 3. systemd: Possibility of denial of logging service by processing native messages from file https://bugzilla.redhat.com/show_bug.cgi?id=859104 4. systemd: Improper sanitization of invalid XKB layouts descriptions (privilege escalation when custom PolicyKit local authority file used) https://bugzilla.redhat.com/show_bug.cgi?id=862324 Thanks! -- Huzaifa Sidhpurwala / Red Hat Security Response Team" Reproducible: Steps to Reproduce:
Version: 2 => CauldronAssignee: bugsquad => mageiaWhiteboard: (none) => MGA3TOO, MGA2TOO
I'm pretty sure none of these affects mga3 (certainly the patch for 1 is already included, we do not use SELinux so I suspect 2 does not apply. for 4 I suspect the fix is 0b507b17a760b21e33fc52ff377db6aa5086c680 which we have - not 100% sure about 3 yet). As for mga2, 2 still does not apply. 4 might apply, and 1 and 2 might again also apply). Without knowing the fixes that are applied I cannot say for sure. Col
On 10/01/2013 01:26 AM, Huzaifa Sidhpurwala wrote: > Hi All, > > I would like to request CVE ids for 4 systemd issues. > > 1. systemd: Integer overflow, leading to heap-based buffer overflow > by processing native messages > https://bugzilla.redhat.com/show_bug.cgi?id=859051 Please use CVE-2013-4391 for this issue. > 2. systemd: TOCTOU race condition when updating file permissions > and SELinux security contexts > https://bugzilla.redhat.com/show_bug.cgi?id=859060 Please use CVE-2013-4392 for this issue. > 3. systemd: Possibility of denial of logging service by processing > native messages from file > https://bugzilla.redhat.com/show_bug.cgi?id=859104 Please use CVE-2013-4393 for this issue. > 4. systemd: Improper sanitization of invalid XKB layouts > descriptions (privilege escalation when custom PolicyKit local > authority file used) > https://bugzilla.redhat.com/show_bug.cgi?id=862324 Please use CVE-2013-4394 for this issue. > Thanks! > > -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
URL: http://www.openwall.com/lists/oss-security/2013/10/01/5 => http://lwn.net/Vulnerabilities/570330/
====================================================== Name: CVE-2013-4391 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4391 Final-Decision: Interim-Decision: Modified: Proposed: Assigned: 20130612 Category: Reference: MLIST:[oss-security] 20131001 Re: [CVE request] systemd Reference: URL:http://www.openwall.com/lists/oss-security/2013/10/01/9 Reference: CONFIRM:http://cgit.freedesktop.org/systemd/systemd/commit/?id=505b6a61c22d5565e9308045c7b9bf79f7d0517e Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=859051 Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large journal data field, which triggers a heap-based buffer overflow. ====================================================== Name: CVE-2013-4392 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4392 Final-Decision: Interim-Decision: Modified: Proposed: Assigned: 20130612 Category: Reference: MLIST:[oss-security] 20131001 Re: [CVE request] systemd Reference: URL:http://www.openwall.com/lists/oss-security/2013/10/01/9 Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=859060 systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files. ====================================================== Name: CVE-2013-4393 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4393 Final-Decision: Interim-Decision: Modified: Proposed: Assigned: 20130612 Category: Reference: MLIST:[oss-security] 20131001 Re: [CVE request] systemd Reference: URL:http://www.openwall.com/lists/oss-security/2013/10/01/9 Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=859104 journald in systemd, when the origin of native messages is set to file, allows local users to cause a denial of service (logging service blocking) via a crafted file descriptor. ====================================================== Name: CVE-2013-4394 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4394 Final-Decision: Interim-Decision: Modified: Proposed: Assigned: 20130612 Category: Reference: MLIST:[oss-security] 20131001 Re: [CVE request] systemd Reference: URL:http://www.openwall.com/lists/oss-security/2013/10/01/9 Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=862324 The SetX11Keyboard function in systemd, when PolicyKit Local Authority (PKLA) is used to change the group permissions on the X Keyboard Extension (XKB) layouts description, allows local users in the group to modify the Xorg X11 Server configuration file and possibly gain privileges via vectors involving "special and control characters."
Summary: Multiple vulnerabilities in systemd => Multiple vulnerabilities in systemd (CVE-2013-4391, CVE-2013-4392, CVE-2013-4393, CVE-2013-4394)
Blocks: (none) => 11726
Removing Mageia 2 from the whiteboard due to EOL. http://blog.mageia.org/en/2013/11/21/farewell-mageia-2/
CC: (none) => luigiwalserWhiteboard: MGA3TOO, MGA2TOO => MGA3TOO
RedHat's bugs for these CVE say that the systemd versions in Fedora 18 and 19 (systemd 201 as of their posting) are not affected by these, so Cauldron is certainly not affected. Mageia 3 still may be.
Version: Cauldron => 3Blocks: 11726 => (none)Whiteboard: MGA3TOO => (none)
Colin, can we close this bug?
CC: (none) => mageia
Closing due to Mageia 3 EOL: http://blog.mageia.org/en/2014/11/26/lets-say-goodbye-to-mageia-3/
Status: NEW => RESOLVEDResolution: (none) => OLD
LWN reference for CVE-2016-4393: https://lwn.net/Vulnerabilities/709006/