Systemd - Remote DOS of systemd-resolve service

[Thomas Imbert]

Hello,

We would like to report a vulnerability about systemd which allows to DOS the systemd-resolve service.

The vulnerability is described in the attached PDF file.

Sincerely,
Thomas IMBERT
Sogeti ESEC R&D

[Seth Arnold (seth-arnold)]

Hello Thomas,

I've sent this along to upstream. Nice find.

Thanks

[Martin Pitt (pitti)]

Is there a CVE for this?

Do we need a formal embargo for this? (IMHO not, I'd classify it as annoying, but non-critical remote DoS) I. e. when can the fix be pushed upstream?

Thanks!

[Marc Deslauriers (mdeslaur)]

We (Ubuntu) don't require an embargo. Let's see if the original reporter requests one.

[Thomas Imbert (mastho)]

Do you think this vulnerability deserve a CVE as the bug isn't really critical ? How do we request a CVE ID ?

We also don't require an embargo on the release of the fix.

Thank you,

[Martin Pitt (pitti)]

A CVE is not about "critical", it's just a succinct name/label to put into changelogs, patches, etc. to say what you are talking about. But of course "LP: #1725351" just works as well as a reference. :-) (but it's distro specific)

[Thomas Imbert (mastho)]

Ok, thank you,

If we want to ask for a CVE ID, should we contact MITRE?

[Marc Deslauriers (mdeslaur)]

Please do. You can use the form here:

https://cveform.mitre.org/

Please add a comment here with the CVE number you obtained. Thanks!

[Thomas Imbert (mastho)]

Form submitted!
Now, I guess we need to wait for their response.

Thanks

[Zbigniew Jędrzejewski-Szmek (zbyszek-in)]

Fix submitted upstream: https://github.com/systemd/systemd/pull/7184

[Marc Deslauriers (mdeslaur)]

Can I make this bug public?

[Martin Pitt (pitti)]

@Marc: Everyone agreed to not have an embargo, and the downstream PR is public. It doesn't have much detail, but IMHO this can become public now.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "resolved-fix-loop-on-packets-with-pseudo-dns-types.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Thomas Imbert (mastho)]

MITRE has assigned the CVE-2017-15908 for this vulnerability.

[Launchpad Janitor (janitor)]

This bug was fixed in the package systemd - 232-21ubuntu7.1

---------------
systemd (232-21ubuntu7.1) zesty-security; urgency=medium

  * SECURITY UPDATE: remote DoS in resolve (LP: #1725351)
    - debian/patches/CVE-2017-15908.patch: fix loop on packets with pseudo
      dns types in src/resolve/resolved-dns-packet.c.
    - CVE-2017-15908

 -- Marc Deslauriers <email address hidden> Thu, 26 Oct 2017 07:59:03 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package systemd - 234-2ubuntu12.1

---------------
systemd (234-2ubuntu12.1) artful-security; urgency=medium

  * SECURITY UPDATE: remote DoS in resolve (LP: #1725351)
    - debian/patches/CVE-2017-15908.patch: fix loop on packets with pseudo
      dns types in src/resolve/resolved-dns-packet.c.
    - CVE-2017-15908

 -- Marc Deslauriers <email address hidden> Thu, 26 Oct 2017 07:56:42 -0400

[David Glasser (glasser)]

We manually enable systemd-resolved.service on xenial. It's installed though it is not the default. Does that mean we are not going to get the fix for this?

I'm also not an expert on NSEC/DNSSEC. Is this something that any random app that uses DNS can be vulnerable too, or does it require a program to specifically be trying to invoke DNSSEC somehow?

[Launchpad Janitor (janitor)]

This bug was fixed in the package systemd - 235-2ubuntu3

---------------
systemd (235-2ubuntu3) bionic; urgency=medium

  * Revert "Skip test-bpf in autopkgtest, currently is failing."
    This reverts commit 75cf986e450e062a3d5780d1976e9efef41e6c4c.
  * Fix test-bpf test case on ubuntu.
  * Skip rename tests in containers, crude fix for now.

 -- Dimitri John Ledkov <email address hidden> Mon, 13 Nov 2017 00:06:42 +0000

[David Glasser (glasser)]

@mdeslaur: Should I interpret the release of https://usn.ubuntu.com/usn/usn-3558-1/ as saying that the answer to my question in comment 19 is that yes, now we are getting the response?

[Marc Deslauriers (mdeslaur)]

Hello. Yes, USN-3558-1 included the fix for Ubuntu 16.04 LTS for environments where systemd-resolved is manually enabled. Thanks.

[David Glasser (glasser)]

Thanks Marc! Do you happen to know the answer to my other question?

"I'm also not an expert on NSEC/DNSSEC. Is this something that any random app that uses DNS can be vulnerable too, or does it require a program to specifically be trying to invoke DNSSEC somehow?"

[Marc Deslauriers (mdeslaur)]

Sorry, I don't know the answer to that question.