CVE-2016-7796
published 2016-10-13CVE-2016-7796: The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a…
PriorityP416medium5.5CVSS 3.0
AVLACLPRLUINSUCNINAH
EPSS
0.85%
54.3th percentile
The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a notify socket, which causes an error to be returned and the notification handler to be disabled.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | systemd | < systemd 231-9 (bookworm) | systemd 231-9 (bookworm) |
| novell | suse_linux_enterprise_desktop | — | — |
| novell | suse_linux_enterprise_server | — | — |
| novell | suse_linux_enterprise_server_for_sap | — | — |
| novell | suse_linux_enterprise_software_development_kit | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_hpc_node | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | >= 0 < 231-9 | 231-9 |
| systemd_project | systemd | >= 0 < 231-9 | 231-9 |
| systemd_project | systemd | >= 0 < 231-9 | 231-9 |
| systemd_project | systemd | >= 0 < 231-9 | 231-9 |
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:N/A:C
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cm6j-6m6x-hmjq: The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received ov
ghsa_unreviewed·2022-05-17
CVE-2016-7796 [MEDIUM] CWE-20 GHSA-cm6j-6m6x-hmjq: The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received ov
The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a notify socket, which causes an error to be returned and the notification handler to be disabled.
OSV
CVE-2016-7796: The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received ov
osv·2016-10-13·CVSS 5.5
CVE-2016-7796 [MEDIUM] CVE-2016-7796: The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received ov
The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a notify socket, which causes an error to be returned and the notification handler to be disabled.
Red Hat
systemd: freeze when PID 1 receives a zero-length message over notify socket
vendor_redhat·2016-09-28·CVSS 5.5
CVE-2016-7796 [MEDIUM] CWE-253 systemd: freeze when PID 1 receives a zero-length message over notify socket
systemd: freeze when PID 1 receives a zero-length message over notify socket
The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a notify socket, which causes an error to be returned and the notification handler to be disabled.
A flaw was found in the way systemd handled empty notification messages. A local attacker could use this flaw to make systemd freeze its execution, preventing further management of system services, system shutdown, or zombie process collection via systemd.
Debian
CVE-2016-7796: systemd - The manager_dispatch_notify_fd function in systemd allows local users to cause a...
vendor_debian·2016·CVSS 5.5
CVE-2016-7796 [MEDIUM] CVE-2016-7796: systemd - The manager_dispatch_notify_fd function in systemd allows local users to cause a...
The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a notify socket, which causes an error to be returned and the notification handler to be disabled.
Scope: local
bookworm: resolved (fixed in 231-9)
bullseye: resolved (fixed in 231-9)
forky: resolved (fixed in 231-9)
sid: resolved (fixed in 231-9)
trixie: resolved (fixed in 231-9)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-7796 systemd: freeze when PID 1 receives a zero-length message over notify socket
bugzilla·2016-10-05·CVSS 5.5
CVE-2016-7796 [MEDIUM] CVE-2016-7796 systemd: freeze when PID 1 receives a zero-length message over notify socket
CVE-2016-7796 systemd: freeze when PID 1 receives a zero-length message over notify socket
It was found that systemd fails an assertion in manager_invoke_notify_message() when a zero-length message is received over its notification socket, causing it to no longer perform it's expected functionality. This issue was assigned CVE-2016-7795 and is tracked via bug 1380286. Upstream bug report is:
https://github.com/systemd/systemd/issues/4234
Older systemd versions either don't include the assert that is triggered in manager_invoke_notify_message(), or have manager_process_notify_fd() function return error before calling manager_invoke_notify_message(). That error return still causes systemd to exit its main loop and freeze its execution in a similar way it's done in newer versions after fai
Bugzilla
CVE-2016-7795 systemd: Assertion failure when PID 1 receives a zero-length message over notify socket
bugzilla·2016-09-29·CVSS 5.5
CVE-2016-7795 [MEDIUM] CVE-2016-7795 systemd: Assertion failure when PID 1 receives a zero-length message over notify socket
CVE-2016-7795 systemd: Assertion failure when PID 1 receives a zero-length message over notify socket
It was found that systemd fails an assertion in manager_invoke_notify_message when a zero-length message is received over its notification socket. After failing the assertion, PID 1 hangs in the pause system call, making no longer possible to start and stop daemons or cleanly reboot the system. Inetd-style services managed by systemd no longer accept connections.
Since the notification socket, /run/systemd/notify, is world-writable, this allows a local user to perform a denial-of-service attack against systemd.
PoC:
NOTIFY_SOCKET=/run/systemd/notify systemd-notify ""
Upstream bug report:
https://github.com/systemd/systemd/issues/4234
CVE request:
http://www.openwall.com/lists/oss-s
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00015.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00016.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0003.htmlhttp://www.openwall.com/lists/oss-security/2016/09/30/1http://www.securityfocus.com/bid/93250http://www.securitytracker.com/id/1037320https://bugzilla.redhat.com/show_bug.cgi?id=1381911https://github.com/systemd/systemd/issues/4234#issuecomment-250441246https://rhn.redhat.com/errata/RHBA-2015-2092.htmlhttps://www.agwa.name/blog/post/how_to_crash_systemd_in_one_tweethttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00015.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00016.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0003.htmlhttp://www.openwall.com/lists/oss-security/2016/09/30/1http://www.securityfocus.com/bid/93250http://www.securitytracker.com/id/1037320https://bugzilla.redhat.com/show_bug.cgi?id=1381911https://github.com/systemd/systemd/issues/4234#issuecomment-250441246https://rhn.redhat.com/errata/RHBA-2015-2092.htmlhttps://www.agwa.name/blog/post/how_to_crash_systemd_in_one_tweet
2016-10-13
Published