Opened 4 years ago

Closed 4 years ago

#13100 closed enhancement (wontfix)

Generate security patch for systemd CVE-2020-1712

Reported by: Douglas R. Reno Owned by: Douglas R. Reno
Priority: high Milestone: 9.1
Component: BOOK Version: systemd
Severity: normal Keywords:


Generate a security patch for this (after build testing):


A heap use-after-free vulnerability was found in systemd, when asynchronous
Polkit queries are performed while handling Dbus messages. A local unprivileged
attacker can abuse this flaw to crash systemd services or potentially execute
code and elevate their privileges, by sending specially crafted Dbus messages.

CVE-2020-1712 has been assigned to this issue.

This flaw happens due to the way bus_verify_polkit_async() works. Some DBus
interfaces use a cache to store objects for a short period and they clear it as
soon as the bus is again in the idle state. However, if a DBus method uses
bus_verify_polkit_async(), the method may have to wait a while until the polkit
action is resolved and when that happens the method handler is called again,
with the userdata previously allocated. If the polkit request takes too long,
the clearing of the cache would free the stored objects before the method is
called the second time, causing the use-after-free vulnerability.

The issue was reported by Tavis Ormandy, Google Project Zero.

Upstream fix is included in v245-rc1:

Riccardo Schirone
Red Hat -- Product Security
PGP-Key ID: CF96E110

Change History (2)

comment:1 by Douglas R. Reno, 4 years ago

Owner: changed from blfs-book to Douglas R. Reno
Status: newassigned

comment:2 by Douglas R. Reno, 4 years ago

Resolution: wontfix
Status: assignedclosed

I have discovered a problem while attempting to patch this. Multiple files that the commit references do not exist, and I don't think it's worthwhile to attempt to create them. Let's fix this as part of 245-rc1.

I don't think it's smart to backport the following fix first in order to make the bus-polkit file exist:

Several other commits would potentially need to be backported after that.

Let's wait for 245 final.

Note: See TracTickets for help on using tickets.