Vulnerability Details : CVE-2016-7795

The manager_invoke_notify_message function in systemd 231 and earlier allows local users to cause a denial of service (assertion failure and PID 1 hang) via a zero-length message received over a notify socket.

Vulnerability category: Input validationDenial of service

Published 2016-10-13 14:59:13

Updated 2017-07-28 01:29:07

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2016-7795

Probability of exploitation activity in the next 30 days: 0.04%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2016-7795

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
4.9	MEDIUM	AV:L/AC:L/Au:N/C:N/I:N/A:C	3.9	6.9	nvd@nist.gov
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete
5.5	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	1.8	3.6	nvd@nist.gov
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2016-7795

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-7795

http://www.ubuntu.com/usn/USN-3094-1

USN-3094-1: Systemd vulnerability | Ubuntu security notices
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2694.html

RHSA-2016:2694 - Security Advisory - Red Hat Customer Portal
http://www.securityfocus.com/bid/93223

systemd 'manager_invoke_notify_message()' Function Local Denial of Service Vulnerability
Third Party Advisory;VDB Entry
https://www.agwa.name/blog/post/how_to_crash_systemd_in_one_tweet

How to Crash Systemd in One Tweet
Exploit;Technical Description;Third Party Advisory

CVEs referencing this url
http://www.securitytracker.com/id/1037320

systemd Zero-Length Notification Processing Flaw Lets Local Users Cause Denial of Service Conditions - SecurityTracker

CVEs referencing this url
https://github.com/systemd/systemd/issues/4234

Assertion failure when PID 1 receives a zero-length message over notify socket · Issue #4234 · systemd/systemd · GitHub
Exploit;Patch;Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/09/28/9

oss-security - CVE Request: systemd v209+: local denial-of-service attack
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/09/30/1

oss-security - Re: CVE Request: systemd v209+: local denial-of-service attack
Third Party Advisory

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2016-2610.html

RHSA-2016:2610 - Security Advisory - Red Hat Customer Portal

Products affected by CVE-2016-7795

Canonical » Ubuntu Linux » Version: 16.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Matching versions
Systemd Project » Systemd
Versions up to, including, (<=) 231
cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*
Matching versions