CVE-2018-16865

Se ha descubierto una asignación de memoria sin límites que podría resultar en que la pila choque con otra región de memoria, en systemd-journald, cuando se envían muchas entradas al socket de journal. Un atacante local, o uno remoto si se emplea systemd-journal-remote, podría emplear este error para provocar el cierre inesperado de systemd-journald o ejecutar código con privilegios de journald. Son vulnerables las versiones hasta la v240.

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges.

An update that solves four vulnerabilities and has 7 fixes is now available. This update for systemd provides the following fixes. Fixed two memory corruptions through attacker-controlled allocas. Fixed an information leak in journald. Fixed mishandling of symlinks present in non-terminal path components to tty units VT. In SLE-12-SP3, 80-hotplug-cpu-mem.rules has a memory hot-add rule that uses systemd-detect-virt to detect non-zvm environment. The systemd-detect-virt returns exit failure code when it detected _none_ state. The exit failure code causes that the hot-add memory block can not be set to online. This update was imported from the SUSE:SLE-15:Update update project.