Slashdot Mirror
Linux systemd Affected by Memory Corruption Vulnerabilities, No Patches Yet (bleepingcomputer.com)
Major Linux distributions are vulnerable to three bugs in systemd, a Linux initialization system and service manager in widespread use, California-based security company Qualys said late yesterday. From a report: The bugs exist in 'journald' service, tasked with collecting and storing log data, and they can be exploited to obtain root privileges on the target machine or to leak information. No patches exist at the moment. Discovered by researchers at Qualys, the flaws are two memory corruption vulnerabilities (stack buffer overflow - CVE-2018-16864, and allocation of memory without limits - CVE-2018-16865) and one out-of-bounds error (CVE-2018-16866). They were able to obtain local root shell on both x86 and x64 machines by exploiting CVE-2018-16865 and CVE-2018-16866. The exploit worked faster on the x86 platform, achieving its purpose in ten minutes; on x64, though, the exploit took 70 minutes to complete. Qualys is planning on publishing the proof-of-concept exploit code in the near future, but they did provide details on how they were able to take advantage of the flaws.
Giant bloated executable where trim purpose built utilities and text should be used.
Looking at the code, all three of these bugs are inexcusable. The systemd devs really are incompetent.
"Meritocracy!"
Go google it
I haven't seen a systemd thread for quite some time around here I guess we're due.
Some of the rants and raves are actually pretty good.
Yet I can't help wondering how much of it is really just people who resist change because they don't want to learn something new. The init/upstart process was easy enough to understand but clinky and as full of problems as systemd really. Except, of course of the most common use cases where it had been worked out.
As for these bugs they don't seem to be making much of an industry problem.
In case you're interested to know the breakdown...
Politics; n. : A religion whereby man is god.
Is SystemD, acronymous for System Dump ?
for me... I switched to Devuan a few months ago.
Yes, I know there are plenty of bugs and vulnerabilities to go around, but based on the frustrations that systemd caused me, I think I am afforded a bit of schadenfreude.
My beliefs do not require that you agree with them.
"It's not a bug, but a feature. Or someone else can work around it. Also: Don't be so mean to us, boo hoo."
Shitty windows-ini-style Unit files, binary logs, 12 different subsystems gobbled up and "integrated" ... I mean did this kind of shit surprise someone? Really? After years of supporting Systemd and solving it's problems for others I can say with limited authority that, yes, it really is garbage. I know there were a few people who thought systemd was just "progress", but no it's a schism, a coup, a shitty revolution that left everyone worse than when they started. Linus and friends are too old and retarded now apparently to lose face and be critical of it because they stood by and shrugged while the Potterites and Fedora assholes ruined Linux. I mean BSD was always better, don't get me wrong. So, it's not as big a loss as some would frame it to be. However, it used to be fun, useful, and relatively untainted by anything this heinous but a few unenlightened windows folks came along and created this svchost.exe ripoff (systemd) for the purposes of enhancing GNOME and now you get this smelly mess that is now Linux. Ah well, it was (sorta) fun while it lasted. Back to my BSD boxes.
nt
You just don't get these kind of problems for the most part.
Yeah, you're right. Microsoft hardly ever has security vulnerabilities. It's practically unheard of.
And when you do, they get fixed by professionals.
That depends entirely on the vendors viewpoint.
You label it a "bug" and demand a fix. They respond by calling it a "feature", and then kindly tell you to Fuck Off, because the definition of "professional" is having more lawyers and money than you.
Fortunately, I run Linux, not Poetterix and are nicely unaffected.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I think they were trying to be funny, really. or maybe not.
As much as there are issues around systemd, this seems to make Qualys attention whores and even worse jerks.
As stated in 2016 at FSCONS in the Q&A https://youtu.be/wMvyOGawNwo?t...
Two of the bugs only possible in with unsafe referencing/allocation ... par for the course.
"Giant bloated executable..."
SystemD causes a lot of problems. That makes more money for people who work for companies that do Linux technology support.
Is that a giant conflict of interest? Was SystemD allowed by management of Red Hat because it would make more money?
Mark Shuttleworth said, "Losing graciously". (Feb. 14, 2014} "It will no doubt take time to achieve the stability and coverage that we enjoy today..."
I fail to see the upshot of "women".
Wow! This must be an amazing piece of software. Such high quality!
https://www.qualys.com/2019/01... :
2018-11-26: Advisory sent to Red Hat Product Security (as recommended by
https://github.com/systemd/sys...).
2018-12-26: Advisory and patches sent to linux-distros@openwall.
2019-01-09: Coordinated Release Date (6:00 PM UTC).
Meanwhile, just two articles earlier on the same exact page you just posted to: "Windows 7 Users Who Installed January Update Report Network Issues; Some Say the Update Has Also Incorrectly Flagged Their OS License as 'Not Genuine'"
Slackware ships with a simple, effective BSD-style init populated by simple and readable shell scripts. Its BDFL, Patrick Volkerding, made the decision to purposely avoid systemd like the plague and I think he is right.
Install Slackware, and many sysadmin's worries will go away.
-- Look to the Rose that blows about us--"Lo, Laughing," she says, "into the World I blow..."
-100 points Slytherin!
That is the more polite version of "you incompetent chumps make our searches easy and worthwhile. And we listened to a lot of System of a Dawn."
#fakenews
Let me go make some popcorn.
Honestly I never really cared about this crap. It was mostly eyerolls from me when people first started complaining.
Until I tried to extract logs... pulling data from journalctl is like watching paint dry (see also windows event viewer)
Until I noticed the top CPU user is fricking systemd logging shit from Internet SSH probe spam.
Now we have privilege escalation vulns galore and this is far from the first time.
And for what exactly? What value has systemd ever provided to anyone that makes tolerating this garbage worthwhile?
Thank you, SystenD! May I have another?
They were able to obtain local root shell on both x86 and x64 machines by exploiting CVE-2018-16865 and CVE-2018-16866. The exploit worked faster on the x86 platform, achieving its purpose in ten minutes; on x64, though, the exploit took 70 minutes to complete.
If someone has local access to your machine, you're doing it wrong anyway.
I know systemd is unpopular here, and I get the arguments why, but it has always worked well for me and these bugs seem fairly minor.
Patch it? They're going to FORK it. That's how we have our cake and eat it too!
Keep It Simple Stupid!
I haven't installed an update for windows 7 since I created the image: it's the reason I use windows 7. No more stupid updates or if there are I can install when I want.
Even simpler than a systemd declaration is saying "Alexa, start Apache".
That doesn't mean that Alexa's AI code is simpler than a 20-line bash script. You're comparing the *input* to the systemd code, a config file, vs the actual code that does things in SysVinit.
In sys V, the shell script starts the daemon, it *is* the code. If anything is wrong or you want to change anything, you can look through the shell script and change things. In systemd, the declaration is handed to a binary that does who-knows-what.
I was a RedHat user back on v5.1. I tried to upgrade my system, and it was awfully painful. But I stuck with RedHat. Then I upgraded again. And again. Every time it got a little less painful, but it still sucked. Then I decided to try out another distro. Mandrake. It was nice, and I liked KDE! I upgraded a couple of times, and it wasn't too bad. So change was good. After a few more upgrades, it still wasn't that smooth. I decided to try out Ubuntu, and I really liked it. Since I was liking KDE I switched to Kubuntu. Change was good! I upgraded a couple of times - near flawless! Change was great! Then KDE started to really annoy me - too much flash, and eventually a bug cropped up that caused me all kinds of headaches. So I switched to Xubuntu. XFCE was great, and change was good! I upgraded that system several times, and it was very smooth. After 7 upgrades, things were getting less stable. Since i was going to reinstall anyway, i looked at other distros.... ah, Linux Mint. Polished, but with XFCE not overly so. I had found my distro, change was great! The method of upgrading was to reinstall cleanly, so I made sure to set up my new system so that was minimally painful. Then I was able to upgrade in place - painlessly! All was right.
Then after one upgrade, I noticed that my machine started having various issues. I couldn't shutdown cleanly. I would take minutes to shutdown, where it used to take seconds. I thought it was hardware at first, but it wasn't. It was systemd. I hadn't noticed before upgrading that they were switching to systemd. I had begun to trust Mint so much that I just thought it would be smooth. I learned more and more about systemd, and tried to fix the issue. No deal. So I gritted my teeth and dealt with it. Change can be bad. Eventually I got a different computer, and then I had complete confirmation that my issues weren't hardware related because they persisted. It was time to find a new distro.
It wasn't an easy search, because by this time systemd had kind of taken over. Mint only went to it because it's a downstream of Ubuntu. Clem (maintainer of Mint) confirmed this to me, that it wasn't his choice at all and it was just the easiest route to take.
I looked at the BSDs, Arch, Slack, and a few others. But because I was familiar with and really liked the apt package manager, I chose Devuan. It was not only a great distro, but I know that it is specifically focused on NOT implementing systemd. It was a simple install and upgrade, and my system is fast as ever and shuts down within seconds again. So again... change is great!
My beliefs do not require that you agree with them.
This is a legitimate question. Most people on slashdot seem to hate systemd. And most of you are programmers and work on Linux every day. Why don't you guys get together and create a new init system that blows systemd away? Isn't that what the whole spirit of FOSS is about?
...that broke the camel's back? FINALLY? PLEASE?????
Can the idiotic pro-systemd folks finally admit they were wrong, abandon the whole misguided concept, and start the process of moving back to unix philosophies and architecture? The world dropped xfree86 fast as a hat, pretty much spun on a dime and moved to X.org.... let that happen w/ systemd as well.
Or, better yet, just shift support en masse behind FreeBSD and get the hardware and desktop environment and app support back up there like it used to be. Honestly, that'd be the better path and the end result so much better.
Probably too much to hope for...
I come not to praise systemd, and certainly not to praise Poettering or RedHat...
But these anti-systemd rants would be more impressive if you guys had showed any signs of thinking through what you're saying about The Unix Way and all that jazz.
Yes, sometimes decentralized, small encapsulated components are a win, but sometimes monolithic designs where the pieces can talk to each other easily are a win-- You might notice that when Linus Torvalds was asked about this he made some rather mild comments about how some aspects of linux, like the graphic display environment has always been more monolithic.
Arguably, the initial reason perl was a big deal is it took a bunch of features from the shell programming world and stuck them all inside of one process-- you can do lash-ups of shell, awk, sed and so on, or you can just write a perl script and pretty frequently the perl script is really and truly a better option.
And take a look at some of the classic shell utilities some time. Look at the docs for things like "find", "tar", etc... do they really look to you like something that's designed to just do "one thing"?
You guys who keep intoning "the unix philosophy" over-and-over might want to stop and think about the way things really get done with unix.
But then, none of this is a defense of systemd, or the way systemd was put over...
...for Linus Torvalds to write an init system like the way he did Git when Bitkeeper license was revoked. He is the only one who can get the devs behind the new system instead of the fucktard Pottering.
Now I understand why so many people were so adamant about how terrible systemd was going to be.
I'm not a programmer, so didn't really understand what the problem was.
Reflect back on "programs that do one thing and do it well".
Are the deep parts of an OS you are using still supportive of that philosophy?
If not consider changing to a better quality OS.
Domestic spying is now "Benign Information Gathering"
There's an infinite way to fuck up with them though and their pattern matching is no match for our creativity at fucking up.
Yet people commonly keep screwing up in the same way, and rarely seem to find new ways to screw up. And while there may be many ways to screw up (not infinite, mind, but the point you were really making, ie "a very very large number with lots of zeros" ways of screwing up is certainly true. Given this plethora of methods of wreaking havoc on ourselves, it's interesting that we generally gravitate to the same old mistakes over and over.
Which is why static code analysis definitely has its place, and there's really no excuse for the systemd people not using it to catch these sorts of things (which are old problems that have cropped up again and again because ... people tend to gravitate to the same set of mistakes they keep making time and time again). But then, there's no excuse for a lot of things the systemd developers have been doing these past several years, so adding this one to the pile really shouldn't surprise too many people.
I don't mind that services have a simple config declaration, with mostly standard start / stop handling. But it would be better to start with some form of "#!/..." so the config file can be used as a script that launches a generic service handler from a traditional init system.
But that's not the only part of the OS that systemd is trying to replace...
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
I wasn't really trolling regardless of what the moderator tally is. I was just remarking that this topic really is a hot button for a lot of people and are willing to write flames about it. And that it hadn't happened for a while.
And was I wrong? Oh, no.
I also pointed out that some people have more valid justifications for their passionately held positions than others. Although that is always true on that topic the jury will always be out.
JournalD is used to look at binary system logs, yet can not look at binary logs stored in another volume. This is more than useless in forensics and recovery.
Had to deal with the default logger's throttle/drop-on-the-floor behaviour when RedHat modified docker's default logging driver to use journald. We spent a while scratching our heads wondering why we couldn't see certain critical messages in our logs for container runs. If you use docker expecting chatty programs in the container to retain all messages, you have to switch to the json logger (which is default docker, no good reason RedHat changed it other than to be jerks).
Nope to systemd, I'd rather use older, tried and tested init systems.
Using binfmt_misc (or a GUI front-end to it) you can fairly easily configure your system to use whatever program you want to handle *.service "scripts". It can recognize them by name (.service) and/or by the first bytes being [Unit] or [Service]. This is similar to configuring a default handler for jpeg files, to open them when you click them (but also works from the command line).
For other file types that don't have a predictable name, nor predictable first bytes, a very simple kernel module can be used to register a handler.
Lastly, text files of unknown type are sent to /bin/sh if they are chmod executable. You can probably configure sh to handle service files.
I've been a user off and on since the version 1 series and currently use 14.2 with updates from the current tree including Clang 7.0.1 and GCC 8.2.0
https://en.wikipedia.org/wiki/Church_of_the_SubGenius
Isn't the binary in sys V the shell?
Version 2.0 systemd patch is available @ https://devuan.org/get-devuan.
https://voidlinux.org
Commonalities with Arch: :o)
- For people who have some basic understanding of the system and are not mortally afraid of the command line.
- Rolling release
- No bloat, unless it's requested
- No nanny attitude
- Main source of info: the Arch Linux Wiki
Differences: ;o)
- Uses runit as its services init / supervision system: parallel services startup (pretty quick), does all a standard client / simple server needs, uses shell scripts, simple, non-invasive.
- Uses libressl by default
- Uses xbps as its package manager: pretty similar to pacman, but split into sub-commands (xbps-install, xbps-query etc.)
- Provides xbps-src to compile packages from source / edit packages / create own packages (Arch's ABS is unsupported now AFAIK)
- Much smaller community (which really should change
been using linux since 95 and i've seen all kinds of bugs throughout the years.
it looks like systemd is remaking all of them again, each time i think - this already happened before, it shouldn't be a problem anymore.
seems as if the systemd team is recreating the complete history of linux userland bugs again.
On a long enough timeline, the survival rate for everyone drops to zero.
Wasn't there a article about adding bugs to the os to tie up hackers time?
As the saying goes; bad workmen blame their tools.
Maybe it's not the C language, but rather the patriarchal misogynist rape-culture of the IT industry and a clear sign that systemd developers should all be replaced by androgynous gender-morphs that take the code's feelings into consideration.
Systemd is a solution looking for a problem...and then creating new problems in systemd. I happily run Gentoo Linux without systemd. If someone insists on systemd, just push them to Windows 10 instead. Linux doesn't need this crap.
In the 1800's, they yelled, "There's gold in them there hills!".
I the 2000's, they yelled, "There's gold in that there systemd!".
I switched my DNS from NameCheap to CloudFlare recently. After making some untenable discoveries about CloudFlare, I switched back to the NameCheap server. From that point onward, I could not get any email on my website systemd server. Although there was an MX record in the server's DNS setup, the MX record could not be found. After running in circles for several days trying to figure out what was wrong, I decided to restart the server. The MX started showing up. Somehow systemd was simply not recognizing it. This is the type of crap you get from systemd that you never got without it.
Distrowatch says there are 113 alternative distros you can use without systemd
If you like Debian, you use Devuan.
If you like Arch, you use Artix.
Slackware was never tainted, etc...
What are you waiting for? The main idiot is not even Poettering, its the Distro leaders that choose to force you to use it. Of course Fedora is doomed being a Red Hat project...
Is it a coincidence that everything made by Poettering behaves more or less the same buggy and bloated way? You think pulseaudio is an example of excellence? What about avahi and the other crud he made? Just say no to his mindset and rid your system of anything made by him.
http://without-systemd.org/ Take a stand against systemd!
Artix
Your Linux, your init.