ArchLinux: 201811-11: systemd: multiple issues
Summary
- CVE-2018-15686 (privilege escalation)
A security issue has been found in systemd up to and including 239,
where the use of fgets() allows an attacker to escalate privilege via a
crafted service with NotifyAccess.
- CVE-2018-15687 (privilege escalation)
A security issue has been found in systemd up to and including 239,
where a race condition in the chown_one() function can be used to
escalate privileges via a crafted symlink.
- CVE-2018-15688 (arbitrary code execution)
An out-of-bounds write has been found in the dhcpv6 option handing code
of systemd-networkd up to and including v239.
It was discovered that systemd-network does not correctly keep track of
a buffer size in the dhcp6_option_append_ia() function, when
constructing DHCPv6 packets. This flaw may lead to an integer underflow
that can be used to produce an heap-based buffer overflow. A malicious
host on the same network segment as the victim's one may advertise
itself as a DHCPv6 server and exploit this flaw to cause a Denial of
Service or potentially gain code execution on the victim's machine. The
overflow can be triggered relatively easy by advertising a DHCPv6
server with a server-id >= 493 characters long.
Resolution
Upgrade to 239.300-1.
# pacman -Syu "systemd>=239.300-1"
The problems have been fixed upstream in version 239.300.
References
https://bugs.archlinux.org/task/60609 https://bugs.chromium.org/p/project-zero/issues/detail?id=1687 https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1796402 https://github.com/systemd/systemd/pull/10447 https://github.com/systemd/systemd/pull/10450 https://bugs.chromium.org/p/project-zero/issues/detail?id=1689 https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1796692 https://github.com/systemd/systemd/pull/10517 https://bugs.launchpad.net/ubuntu/%2Bsource/systemd/%2Bbug/1795921 https://github.com/systemd/systemd/pull/10518 https://github.com/poettering/systemd/commit/49653743f69658aeeebdb14faf1ab158f1f2cb20 https://security.archlinux.org/CVE-2018-15686 https://security.archlinux.org/CVE-2018-15687 https://security.archlinux.org/CVE-2018-15688
Workaround
- CVE-2018-15688Disable IPv6 by setting either LinkLocalAddressing=ipv4 orLinkLocalAddressing=no in the corresponding network configuration file.