Описание
basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.
A flaw was found in systemd. The use of alloca function with an uncontrolled size in function unit_name_path_escape allows a local attacker, able to mount a filesystem on a very long path, to crash systemd and the whole system by allocating a very large space in the stack. The highest threat from this vulnerability is to the system availability.
Отчет
This issue did not affect the versions of systemd as shipped with Red Hat Enterprise Linux 7 as they did not use strdupa to duplicate strings in unit_name_path_escape function, but strdup, which allocates space on the heap. Further, any Red Hat product which is supported on the Red Hat Enterprise Linux platform is also potentially impacted. This includes:
- Product containers which are based on the RHEL or UBI container images. These images are updated regularly, and container health indicating whether a fix to this flaw is available can be seen in the Container Health Index, part of the Red Hat Container Catalog (https://access.redhat.com/containers). In addition, any customer containers should be manually rebuilt when the base images are updated.
- Products which pull packages from the RHEL channel. Please ensure that the underlying Red Hat Enterprise Linux systemd package is current in these product environments.
Меры по смягчению последствий
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 7 | systemd | Not affected | ||
| Red Hat Enterprise Linux 9 | systemd | Not affected | ||
| Red Hat Enterprise Linux 8 | systemd | Fixed | RHSA-2021:2717 | 21.07.2021 |
| Red Hat Enterprise Linux 8.1 Extended Update Support | systemd | Fixed | RHSA-2021:2724 | 20.07.2021 |
| Red Hat Enterprise Linux 8.2 Extended Update Support | systemd | Fixed | RHSA-2021:2721 | 20.07.2021 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 | redhat-virtualization-host | Fixed | RHSA-2021:2736 | 22.07.2021 |
Показывать по
Дополнительная информация
Статус:
5.5 Medium
CVSS3
Связанные уязвимости
basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.
basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.
basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 ...
5.5 Medium
CVSS3