CVE-2016-7795
systemd: Assertion failure when PID 1 receives a zero-length message over notify socket
Severity Score
5.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The manager_invoke_notify_message function in systemd 231 and earlier allows local users to cause a denial of service (assertion failure and PID 1 hang) via a zero-length message received over a notify socket.
La función manager_invoke_notify_message en systemd 231 y versiones anteriores permite a usuarios locales provocar una denegación de servicio (fallo de afirmación y colgado de PID 1) a través de un mensaje de longitud cero recibido sobre una notificación de encaje.
A flaw was found in the way systemd handled empty notification messages. A local attacker could use this flaw to make systemd freeze its execution, preventing further management of system services, system shutdown, or zombie process collection via systemd.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2016-09-09 CVE Reserved
- 2016-10-13 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
- CWE-617: Reachable Assertion
CAPEC
References (11)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2016/09/28/9 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2016/09/30/1 | Mailing List |
|
| http://www.securityfocus.com/bid/93223 | Third Party Advisory | |
| http://www.securitytracker.com/id/1037320 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://github.com/systemd/systemd/issues/4234 | 2024-08-06 | |
| https://www.agwa.name/blog/post/how_to_crash_systemd_in_one_tweet | 2024-08-06 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2016-2610.html | 2017-07-28 | |
| http://rhn.redhat.com/errata/RHSA-2016-2694.html | 2017-07-28 | |
| http://www.ubuntu.com/usn/USN-3094-1 | 2017-07-28 | |
| https://access.redhat.com/security/cve/CVE-2016-7795 | 2016-11-09 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1380286 | 2016-11-09 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04" | lts |
Affected
| ||||||
| Systemd Project Search vendor "Systemd Project" | Systemd Search vendor "Systemd Project" for product "Systemd" | <= 231 Search vendor "Systemd Project" for product "Systemd" and version " <= 231" | - |
Affected
| ||||||