CVE-2021-33910 - log back

CVE-2021-33910 edited at 20 Jul 2021 13:37:49
Description
- A denial of service security issue has been found in systemd. A local attacker who is able to mount a filesystem with a very long path can crash systemd and the whole system through an attacker-controlled alloca().
+ A denial of service security issue has been found in systemd before version 249.1. A local attacker who is able to mount a filesystem with a very long path can crash systemd and the whole system through an attacker-controlled alloca().
References
https://www.qualys.com/2021/07/20/cve-2021-33910/denial-of-service-systemd.txt
https://www.qualys.com/2021/07/20/cve-2021-33910/cve-2021-33910-crasher.c
https://bugzilla.redhat.com/show_bug.cgi?id=1970887
https://github.com/systemd/systemd/pull/20256
https://github.com/systemd/systemd/commit/441e0115646d54f080e5c3bb0ba477c892861ab9
+ https://github.com/systemd/systemd-stable/commit/764b74113e36ac5219a4b82a05f311b5a92136ce
CVE-2021-33910 edited at 20 Jul 2021 13:21:35
References
https://www.qualys.com/2021/07/20/cve-2021-33910/denial-of-service-systemd.txt
https://www.qualys.com/2021/07/20/cve-2021-33910/cve-2021-33910-crasher.c
https://bugzilla.redhat.com/show_bug.cgi?id=1970887
https://github.com/systemd/systemd/pull/20256
- https://github.com/systemd/systemd/pull/20256/commits/441e0115646d54f080e5c3bb0ba477c892861ab9
+ https://github.com/systemd/systemd/commit/441e0115646d54f080e5c3bb0ba477c892861ab9
CVE-2021-33910 edited at 20 Jul 2021 13:21:15
Description
- Systemd parses the content of /proc/self/mountinfo and each mountpoint is passed to mount_setup_unit(), which calls unit_name_path_escape() underneath. A local attacker who is able to mount a filesystem with a very long path can crash systemd and the whole system.
+ A denial of service security issue has been found in systemd. A local attacker who is able to mount a filesystem with a very long path can crash systemd and the whole system through an attacker-controlled alloca().
References
+ https://www.qualys.com/2021/07/20/cve-2021-33910/denial-of-service-systemd.txt
+ https://www.qualys.com/2021/07/20/cve-2021-33910/cve-2021-33910-crasher.c
https://bugzilla.redhat.com/show_bug.cgi?id=1970887
https://github.com/systemd/systemd/pull/20256
https://github.com/systemd/systemd/pull/20256/commits/441e0115646d54f080e5c3bb0ba477c892861ab9
CVE-2021-33910 edited at 20 Jul 2021 12:29:05
Severity
- Unknown
+ Medium
Remote
- Unknown
+ Local
Type
- Unknown
+ Denial of service
Description
+ Systemd parses the content of /proc/self/mountinfo and each mountpoint is passed to mount_setup_unit(), which calls unit_name_path_escape() underneath. A local attacker who is able to mount a filesystem with a very long path can crash systemd and the whole system.
References
+ https://bugzilla.redhat.com/show_bug.cgi?id=1970887
+ https://github.com/systemd/systemd/pull/20256
+ https://github.com/systemd/systemd/pull/20256/commits/441e0115646d54f080e5c3bb0ba477c892861ab9
Notes
CVE-2021-33910 created at 20 Jul 2021 12:26:46