Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 29 Sep 2016 12:12:00 -0500
From: Mark Hatle <>
To: <>
Subject: Systemd local denial of service

Previously to the oss-security list there was a request for a CVE for a systemd
issue from "".

The gravity of this request missed by attention, and I forwarded information of
the blog: to
the  Per policy, the post and related information is to
also be sent to the oss-security list, as the information is public.

> Just in case you have not seen this elsewhere....

Relevant details:

The following command, when run as any user, will crash systemd:

NOTIFY_SOCKET=/run/systemd/notify systemd-notify ""
After running this command, PID 1 is hung in the pause system call. You can no
longer start and stop daemons. inetd-style services no longer accept
connections. You cannot cleanly reboot the system. The system feels generally
unstable (e.g. ssh and su hang for 30 seconds since systemd is now integrated
with the login system). All of this can be caused by a command that's short
enough to fit in a Tweet.


The above systemd-notify command sends a zero-length message to the
world-accessible UNIX domain socket located at /run/systemd/notify. PID 1
receives the message and fails an assertion that the message length is greater
than zero. Despite the banality, the bug is serious, as it allows any local user
to trivially perform a denial-of-service attack against a critical system component.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.