How to Crash Systemd in One Command • Hacker News Board

Re: How to Crash Systemd in One Command

#191

Post by fridsun » Fri, Sep 30, 2016, 10:29 PM UTC

Lennart Poettering has replied on Reddit.

https://www.reddit.com/r/linux/comments/54yfcd/how_to_crash_...

> So let's summarize this. There's a bug in some software. OMG! Shock! This of course never happened before!

> The bug is in not exploitable remotely. The bug does not allow privilege escalation nor insertion of code. This of course makes the bug a massive vulnerability like there was no other on the planet ... ever. As bad as heartbleed multiplied by the Debian OpenSSL random generator bug to the power of 10.

> The bug is caused by an error check that filters out garbage sent to PID 1. The check works correctly, except that the resulting action is a too harsh: instead of complaining and dropping it will abort the process. Such a bug is of course unprecedented and the authors of said software should be stoned and flogged right away given the severity of the issue: after all a safety check worked a bit too well, and we really can't have that because undefined behaviour of course would be a lot better than a local DoS.

> The project the error was found in is large. Yet the number of CVEs collect so far is pretty small comparing it witht other projects of similar extent. Given that another bug was discovered now this obviously shows how incompetent the programmers are and that security is a unknown concept to them.

> The program the bug was found in is longer than 50 lines of code but runs with privileges, all written in a low-level programming langauge that many call little more than a fancy macro assembler. The code runs on top of an operating system kernel written in the same language but running with a lot higher privileges and consisting of expoentially more lines of code including drivers of questionnable quality. This together is of course proof that the project at hand is flawed conceptually to its core.

> Dha!

> Lennart

> (More seriously: yes this is a bug, we should fix it. But it's very low impact and the bruhaha it generated appears wildly out of scale. If all bugs in the wider Open Source ecosystem would have a similarly low impact we'd live in a much much safer world!)

Re: How to Crash Systemd in One Command

#192

Post by justinsaccount » Sat, Oct 01, 2016, 3:55 AM UTC

ddalex wrote: post #178

justinsaccount wrote: post #135

Earlier quoted context omitted.

There is, but it involves using a standardized structured data exchange format instead of formatted text. powershell solves this by using structured data everywhere at the expensive of not working that well with plain text. You should be able to run something like ls -l | sort +date,-size but you can't :-)

Sure you can. 5th column of `ls -l` is size; sort can do numerical values > ls -tl | sort -k 5 -n

Not the same thing,

  ls -l | sort +date,-size

was to show how sorting by date ascending and size descending could work. 'sort' can sort by different fields in different orders, but to sort times properly you'd need to use ls with `--full-time` or --time-style=long-iso` which is in GNU ls but not the BSD ls on OS X.

You'd end up with something like

  ls -l --full-time |sort -k 6,5rn

But that doesn't quite work. Besides, the 'sort -k 6,5rn' instead of 'sort +date,-size' is exactly the kind of thing I was trying to show.

We could have had a sort that let you do '+date,-size', instead we have a 'universal interface'.

Re: How to Crash Systemd in One Command

#193

Post by JdeBP » Thu, Oct 06, 2016, 6:56 PM UTC

Lennart Poettering's response to this was interesting:

> The bug is caused by an error check that filters out garbage sent to PID 1. The check works correctly, except that the resulting action is a too harsh: instead of complaining and dropping it will abort the process.

* https://www.reddit.com/r/linux/comments/54yfcd/how_to_crash_...

In fact, the opposite was the case. The root of the problem was identified in the GitHub bug report:

* https://github.com/systemd/systemd/issues/4234#issuecomment-...

* hhttps://github.com/systemd/systemd/commit/d875aa8ce10b458dc2...

What happened was that Lennart Poettering removed an error check that filtered out zero-length messages. This left the flow of control to fall through to a later point where an assertion, that had been earlier added by Lennart Poettering with the assumption that this check for zero was in place (as it had been at the time), then triggered.

Of course, no-one that I have seen has yet asked why "" as a command-line argument to systemd-notify results in a zero-length message in the first place. After all, according to the doco that would be length 1, a single terminating LF byte, not zero length. That said, the server still should be proof against zero-length network input.