Multiple Linux Distributions Affected By Crippling Bug In Systemd
'System administrator Andrew Ayer has discovered a potentially critical bug in systemd which can bring a vulnerable Linux server to its knees with one command. "After running this command, PID 1 is hung in the pause system call. You can no longer start and stop daemons. inetd-style services no longer accept connections. You cannot cleanly reboot the system." According to the bug report, Debian, Ubuntu, and CentOS are among the distros susceptible to various levels of resource exhaustion. The bug, which has existed for more than two years, does not require root access to exploit.' -- source: https://linux.slashdot.org/story/16/10/01/2155209 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/
On Sun, 2 Oct 2016 12:49:32 +1300, Peter Reutemann wrote:
'System administrator Andrew Ayer has discovered a potentially critical bug in systemd ...'
... which he has used as a launching point for yet another rant against systemd <https://www.agwa.name/blog/post/how_to_crash_systemd_in_one_tweet>. Rejoinder here <https://medium.com/@davidtstrauss/how-to-throw-a-tantrum-in-one-blog-post-c2ccaa58661d#.3hzjljwci>. Is security more than a matter of opinion?
The true flaw here is monoculture. On 2/10/2016 12:50, "Peter Reutemann" <fracpete(a)waikato.ac.nz> wrote:
'System administrator Andrew Ayer has discovered a potentially critical bug in systemd which can bring a vulnerable Linux server to its knees with one command. "After running this command, PID 1 is hung in the pause system call. You can no longer start and stop daemons. inetd-style services no longer accept connections. You cannot cleanly reboot the system." According to the bug report, Debian, Ubuntu, and CentOS are among the distros susceptible to various levels of resource exhaustion. The bug, which has existed for more than two years, does not require root access to exploit.'
-- source: https://linux.slashdot.org/story/16/10/01/2155209
Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/ _______________________________________________ wlug mailing list | wlug(a)list.waikato.ac.nz Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug
participants (3)
-
Gregory Machin -
Lawrence D'Oliveiro -
Peter Reutemann