Systemd 241 Being Prepared With "System Down" Security Fixes
Written by Michael Larabel in systemd on 13 January 2019 at 08:00 AM EST. 122 Comments
SYSTEMD --
While systemd 240 was released right before Christmas, it looks like systemd 241 will soon be released in order to address the recent "System Down" security vulnerabilities.

In case you missed it from earlier in the week, three vulnerabilities were discovered in systemd's journald: two memory corruption bugs and an information leak due to an out-of-bounds read. These vulnerabilities have been in systemd the past several years and and could enable a local root shell in a matter of minutes on i386 systems or in about an hour on x86_64. Well, except for the likes of Fedora and openSUSE systems that make use of GCC's stack clash protection. Details on those vulnerabilities via Qualys.

The systemd journal code now will reject entries with too many fields as well as setting limits on a process' command line length in order to address CVE-2018-16865 and CVE-2018-16864. Those fixes are in systemd Git now and will be part of the upcoming systemd 241 release.

Other changes currently queued for systemd 241 include allowing the default locale to be configured at compile-time, support for showing the systemd Git commit hash as part of the version string, a new stderr priority option for systemd-cat, an optional initrd file path can be passed to the kernel install script, and the -fPIE option for position-independent executables was punted off to being a Meson option.

The latest systemd Git code for those wanting the fixed-up journald can grab the code for now from systemd on GitHub while waiting for the tagged release.

About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 10,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Related systemd News
Popular News This Week