'Severe' Systemd Bug Allowed Remote Code Execution For Two Years
'A flaw in systemd, the init system used on many Linux systems, can be exploited using a malicious DNS query to either crash a system or to run code remotely. The vulnerability resides in the daemon systemd-resolved and can be triggered using a TCP payload, according to Ubuntu developer Chris Coulson. This component can be tricked into allocating less memory than needed for a look-up. When the reply is bigger it overflows the buffer allowing an attacker to overwrite memory. This would result in the process either crashing or it could allow for code execution remotely. "A malicious DNS server can exploit this by responding with a specially crafted TCP payload to trick systemd-resolved in to allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it," is how Coulson put it.
Affected Linux vendors have pushed out patches -- but the bug has apparently been present in systemd code since June of 2015. And long-time Slashdot reader walterbyrd also reports a recently-discovered bug where systemd unit files that contain illegal usernames get defaulted to root.'
-- source: https://it.slashdot.org/story/17/07/03/0343258
Cheers, Peter
Given the controversy surrounding systemd and the way they operate one just has to wonder "bug or backdoor?"
Malacious DNS, buffer overflow, this thing looks like textbook TLA MO.
systemd is looking more and more suspect to me.
On Tue, 2017-07-04 at 10:47 +1200, Peter Reutemann wrote:
'A flaw in systemd, the init system used on many Linux systems, can be exploited using a malicious DNS query to either crash a system or to run code remotely. The vulnerability resides in the daemon systemd-resolved and can be triggered using a TCP payload, according to Ubuntu developer Chris Coulson. This component can be tricked into allocating less memory than needed for a look-up. When the reply is bigger it overflows the buffer allowing an attacker to overwrite memory. This would result in the process either crashing or it could allow for code execution remotely. "A malicious DNS server can exploit this by responding with a specially crafted TCP payload to trick systemd-resolved in to allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it," is how Coulson put it.
Affected Linux vendors have pushed out patches -- but the bug has apparently been present in systemd code since June of 2015. And long-time Slashdot reader walterbyrd also reports a recently-discovered bug where systemd unit files that contain illegal usernames get defaulted to root.'
-- source: https://it.slashdot.org/story/17/07/03/0343258
Cheers, Peter
On Tue, 2017-07-04 at 12:03 +1200, Lawrence D'Oliveiro wrote:
On Tue, 04 Jul 2017 11:19:49 +1200, gb wrote:
Given the controversy surrounding systemd and the way they operate ...
Whatever do you mean?
My suspicion is that systemd is riddled with spooky coders contributing 'bugs' that act conveniently as backdoors for enabling eavesdropping or even covert remote execution. But plausibly deniable of course, (now you can deny it).
Is that spelled out clearly enough for you?
Contributing compromised code to open source projects is a well-known tactic for compromising security 'enough' to enable spying (spyware) ... so no it is not 'conspiracy theory' lunatic thinking to be wary of these flaws in the way open source software is produced.
The fact that systemd was intent on getting into every corner of the linux OS just makes it a convenient vehicle for delivering a range of options for spooks to compromise linux communications security. Who knows what the true motive for systemd getting into every corner of linux really was though? but, but, 'modularity' seems like a fig leaf at this point btw.
wlug mailing list | wlug@list.waikato.ac.nz Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug
On Thu, 06 Jul 2017 12:07:19 +1200, gb wrote:
My suspicion is that systemd is riddled with spooky coders contributing 'bugs' that act conveniently as backdoors for enabling eavesdropping or even covert remote execution. But plausibly deniable of course, (now you can deny it).
Is that spelled out clearly enough for you?
What is the basis for your suspicion? Remember systemd is open source, you are free to inspect it for “backdoors” or whatever. Who are these “spooky coders”?
Contributing compromised code to open source projects is a well-known tactic ...
[Citation needed]
The fact that systemd was intent on getting into every corner of the linux OS ...
How do you think it succeeded in winning over supporters? Brainwashing?
participants (3)
-
gb -
Lawrence D'Oliveiro -
Peter Reutemann