shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-01-07 21:18:41 +03:00
Code
The systemd System and Service Manager
78,328 Commits 4 Branches 398 Tags 551 MiB
C 89.2%
Python 5.3%
Shell 4.1%
Meson 1.2%
842a674d4f
Go to file
Luca Boccassi 842a674d4f creds: fix use-after-free in varlink interface 
All other usages of sd_varlink_call* do not free the json return parameter,
and it is owned by the varlink object instead. Do the same here.

TEST-54-CREDS.sh[1074]: ==1074==ERROR: AddressSanitizer: heap-use-after-free on address 0x50c00000095a at pc 0x55cf8cd18a0f bp 0x7ffd7b9d4f10 sp 0x7ffd7b9d4f08
TEST-54-CREDS.sh[1074]: READ of size 2 at 0x50c00000095a thread T0 ((sd-mkdcreds))
TEST-54-CREDS.sh[1074]:     #0 0x55cf8cd18a0e in sd_json_variant_unref /usr/src/debug/systemd/src/libsystemd/sd-json/sd-json.c:887:16
TEST-54-CREDS.sh[1074]:     #1 0x55cf8cd4cecb in varlink_clear_current /usr/src/debug/systemd/src/libsystemd/sd-varlink/sd-varlink.c:593:22
TEST-54-CREDS.sh[1074]:     #2 0x55cf8cd4975e in varlink_clear /usr/src/debug/systemd/src/libsystemd/sd-varlink/sd-varlink.c:614:9
TEST-54-CREDS.sh[1074]:     #3 0x55cf8cd3dc3c in varlink_destroy /usr/src/debug/systemd/src/libsystemd/sd-varlink/sd-varlink.c:651:9
TEST-54-CREDS.sh[1074]:     #4 0x55cf8cd3dc3c in sd_varlink_unref /usr/src/debug/systemd/src/libsystemd/sd-varlink/sd-varlink.c:657:1
TEST-54-CREDS.sh[1074]:     #5 0x55cf8cb47a82 in sd_varlink_unrefp /usr/src/debug/systemd/src/systemd/sd-varlink.h:279:1
TEST-54-CREDS.sh[1074]:     #6 0x55cf8cb47a82 in ipc_decrypt_credential /usr/src/debug/systemd/src/shared/creds-util.c:1660:1
TEST-54-CREDS.sh[1074]:     #7 0x55cf8caca99a in maybe_decrypt_and_write_credential /usr/src/debug/systemd/src/core/exec-credential.c:486:29
TEST-54-CREDS.sh[1074]:     #8 0x55cf8cac790b in load_credential /usr/src/debug/systemd/src/core/exec-credential.c:713:16
TEST-54-CREDS.sh[1074]:     #9 0x55cf8cac5403 in acquire_credentials /usr/src/debug/systemd/src/core/exec-credential.c:819:29
TEST-54-CREDS.sh[1074]:     #10 0x55cf8cac5403 in setup_credentials_internal /usr/src/debug/systemd/src/core/exec-credential.c:1023:13
TEST-54-CREDS.sh[1074]:     #11 0x55cf8cac42d4 in exec_setup_credentials /usr/src/debug/systemd/src/core/exec-credential.c:1168:21
TEST-54-CREDS.sh[1074]:     #12 0x55cf8ca59569 in exec_invoke /usr/src/debug/systemd/src/core/exec-invoke.c:4866:13
TEST-54-CREDS.sh[1074]:     #13 0x55cf8ca428d8 in run /usr/src/debug/systemd/src/core/executor.c:244:13
TEST-54-CREDS.sh[1074]:     #14 0x55cf8ca428d8 in main /usr/src/debug/systemd/src/core/executor.c:275:13
TEST-54-CREDS.sh[1074]:     #15 0x7f64b40110c7 in __libc_start_call_main (/lib64/libc.so.6+0x40c7) (BuildId: 159846287d47eef88f2a478f59803f6e8fc81d05)
TEST-54-CREDS.sh[1074]:     #16 0x7f64b401118a in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x418a) (BuildId: 159846287d47eef88f2a478f59803f6e8fc81d05)
TEST-54-CREDS.sh[1074]:     #17 0x55cf8ca41cb4  (/usr/lib/systemd/systemd-executor+0x124cb4) (BuildId: 24f2b1608c3aaee3226cdd14fa2b6e6741156222)
TEST-54-CREDS.sh[1074]: 0x50c00000095a is located 26 bytes inside of 120-byte region [0x50c000000940,0x50c0000009b8)
TEST-54-CREDS.sh[1074]: freed by thread T0 ((sd-mkdcreds)) here:
TEST-54-CREDS.sh[1074]:     #0 0x7f64b48d57ea in free (/usr/lib/clang/19/lib/x86_64-redhat-linux-gnu/libclang_rt.asan.so+0xd57ea) (BuildId: c59bbd28ceb74038a60373d4a8cd4c258bcf0b4e)
TEST-54-CREDS.sh[1074]:     #1 0x55cf8cd188ab in sd_json_variant_unref /usr/src/debug/systemd/src/libsystemd/sd-json/sd-json.c:895:25
TEST-54-CREDS.sh[1074]:     #2 0x55cf8cb47a4c in sd_json_variant_unrefp /usr/src/debug/systemd/src/systemd/sd-json.h:98:1
TEST-54-CREDS.sh[1074]:     #3 0x55cf8cb47a4c in ipc_decrypt_credential /usr/src/debug/systemd/src/shared/creds-util.c:1660:1
TEST-54-CREDS.sh[1074]:     #4 0x55cf8caca99a in maybe_decrypt_and_write_credential /usr/src/debug/systemd/src/core/exec-credential.c:486:29
TEST-54-CREDS.sh[1074]:     #5 0x55cf8cac790b in load_credential /usr/src/debug/systemd/src/core/exec-credential.c:713:16
TEST-54-CREDS.sh[1074]:     #6 0x55cf8cac5403 in acquire_credentials /usr/src/debug/systemd/src/core/exec-credential.c:819:29
TEST-54-CREDS.sh[1074]:     #7 0x55cf8cac5403 in setup_credentials_internal /usr/src/debug/systemd/src/core/exec-credential.c:1023:13
TEST-54-CREDS.sh[1074]:     #8 0x55cf8cac42d4 in exec_setup_credentials /usr/src/debug/systemd/src/core/exec-credential.c:1168:21
TEST-54-CREDS.sh[1074]:     #9 0x55cf8ca59569 in exec_invoke /usr/src/debug/systemd/src/core/exec-invoke.c:4866:13
TEST-54-CREDS.sh[1074]:     #10 0x55cf8ca428d8 in run /usr/src/debug/systemd/src/core/executor.c:244:13
TEST-54-CREDS.sh[1074]:     #11 0x55cf8ca428d8 in main /usr/src/debug/systemd/src/core/executor.c:275:13
TEST-54-CREDS.sh[1074]:     #12 0x7f64b40110c7 in __libc_start_call_main (/lib64/libc.so.6+0x40c7) (BuildId: 159846287d47eef88f2a478f59803f6e8fc81d05)
TEST-54-CREDS.sh[1074]:     #13 0x7f64b401118a in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x418a) (BuildId: 159846287d47eef88f2a478f59803f6e8fc81d05)
TEST-54-CREDS.sh[1074]:     #14 0x55cf8ca41cb4  (/usr/lib/systemd/systemd-executor+0x124cb4) (BuildId: 24f2b1608c3aaee3226cdd14fa2b6e6741156222)
TEST-54-CREDS.sh[1074]: previously allocated by thread T0 ((sd-mkdcreds)) here:
TEST-54-CREDS.sh[1074]:     #0 0x7f64b48d5a83 in malloc (/usr/lib/clang/19/lib/x86_64-redhat-linux-gnu/libclang_rt.asan.so+0xd5a83) (BuildId: c59bbd28ceb74038a60373d4a8cd4c258bcf0b4e)
TEST-54-CREDS.sh[1074]:     #1 0x55cf8cd16bb7 in malloc_multiply /usr/src/debug/systemd/src/basic/alloc-util.h:119:16
TEST-54-CREDS.sh[1074]:     #2 0x55cf8cd16bb7 in sd_json_variant_new_object /usr/src/debug/systemd/src/libsystemd/sd-json/sd-json.c:737:13
TEST-54-CREDS.sh[1074]:     #3 0x55cf8cd32e58 in json_parse_internal /usr/src/debug/systemd/src/libsystemd/sd-json/sd-json.c:3161:29
TEST-54-CREDS.sh[1074]:     #4 0x55cf8cd37326 in sd_json_parse_with_source /usr/src/debug/systemd/src/libsystemd/sd-json/sd-json.c:3408:16
TEST-54-CREDS.sh[1074]:     #5 0x55cf8cd37326 in sd_json_parse /usr/src/debug/systemd/src/libsystemd/sd-json/sd-json.c:3437:16
TEST-54-CREDS.sh[1074]:     #6 0x55cf8cd3f753 in varlink_parse_message /usr/src/debug/systemd/src/libsystemd/sd-varlink/sd-varlink.c:962:13
TEST-54-CREDS.sh[1074]:     #7 0x55cf8cd3f753 in sd_varlink_process /usr/src/debug/systemd/src/libsystemd/sd-varlink/sd-varlink.c:1466:13
TEST-54-CREDS.sh[1074]:     #8 0x55cf8cd4c0a9 in sd_varlink_call_full /usr/src/debug/systemd/src/libsystemd/sd-varlink/sd-varlink.c:2160:21
TEST-54-CREDS.sh[1074]:     #9 0x55cf8cd4d617 in sd_varlink_callb_ap /usr/src/debug/systemd/src/libsystemd/sd-varlink/sd-varlink.c:2237:16
TEST-54-CREDS.sh[1074]:     #10 0x55cf8cd4da3c in sd_varlink_callb /usr/src/debug/systemd/src/libsystemd/sd-varlink/sd-varlink.c:2251:13
TEST-54-CREDS.sh[1074]:     #11 0x55cf8cb47686 in ipc_decrypt_credential /usr/src/debug/systemd/src/shared/creds-util.c:1623:13
TEST-54-CREDS.sh[1074]:     #12 0x55cf8caca99a in maybe_decrypt_and_write_credential /usr/src/debug/systemd/src/core/exec-credential.c:486:29
TEST-54-CREDS.sh[1074]:     #13 0x55cf8cac790b in load_credential /usr/src/debug/systemd/src/core/exec-credential.c:713:16
TEST-54-CREDS.sh[1074]:     #14 0x55cf8cac5403 in acquire_credentials /usr/src/debug/systemd/src/core/exec-credential.c:819:29
TEST-54-CREDS.sh[1074]:     #15 0x55cf8cac5403 in setup_credentials_internal /usr/src/debug/systemd/src/core/exec-credential.c:1023:13
TEST-54-CREDS.sh[1074]:     #16 0x55cf8cac42d4 in exec_setup_credentials /usr/src/debug/systemd/src/core/exec-credential.c:1168:21
TEST-54-CREDS.sh[1074]:     #17 0x55cf8ca59569 in exec_invoke /usr/src/debug/systemd/src/core/exec-invoke.c:4866:13
TEST-54-CREDS.sh[1074]:     #18 0x55cf8ca428d8 in run /usr/src/debug/systemd/src/core/executor.c:244:13
TEST-54-CREDS.sh[1074]:     #19 0x55cf8ca428d8 in main /usr/src/debug/systemd/src/core/executor.c:275:13
TEST-54-CREDS.sh[1074]:     #20 0x7f64b40110c7 in __libc_start_call_main (/lib64/libc.so.6+0x40c7) (BuildId: 159846287d47eef88f2a478f59803f6e8fc81d05)
TEST-54-CREDS.sh[1074]:     #21 0x7f64b401118a in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x418a) (BuildId: 159846287d47eef88f2a478f59803f6e8fc81d05)
TEST-54-CREDS.sh[1074]:     #22 0x55cf8ca41cb4  (/usr/lib/systemd/systemd-executor+0x124cb4) (BuildId: 24f2b1608c3aaee3226cdd14fa2b6e6741156222)
TEST-54-CREDS.sh[1074]: SUMMARY: AddressSanitizer: heap-use-after-free /usr/src/debug/systemd/src/libsystemd/sd-json/sd-json.c:887:16 in sd_json_variant_unref
TEST-54-CREDS.sh[1074]: Shadow bytes around the buggy address:
TEST-54-CREDS.sh[1074]:   0x50c000000680: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
TEST-54-CREDS.sh[1074]:   0x50c000000700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
TEST-54-CREDS.sh[1074]:   0x50c000000780: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
TEST-54-CREDS.sh[1074]:   0x50c000000800: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
TEST-54-CREDS.sh[1074]:   0x50c000000880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
TEST-54-CREDS.sh[1074]: =>0x50c000000900: fa fa fa fa fa fa fa fa fd fd fd[fd]fd fd fd fd
TEST-54-CREDS.sh[1074]:   0x50c000000980: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
TEST-54-CREDS.sh[1074]:   0x50c000000a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
TEST-54-CREDS.sh[1074]:   0x50c000000a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
TEST-54-CREDS.sh[1074]:   0x50c000000b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
TEST-54-CREDS.sh[1074]:   0x50c000000b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
TEST-54-CREDS.sh[1074]: Shadow byte legend (one shadow byte represents 8 application bytes):
TEST-54-CREDS.sh[1074]:   Addressable:           00
TEST-54-CREDS.sh[1074]:   Partially addressable: 01 02 03 04 05 06 07
TEST-54-CREDS.sh[1074]:   Heap left redzone:       fa
TEST-54-CREDS.sh[1074]:   Freed heap region:       fd
TEST-54-CREDS.sh[1074]:   Stack left redzone:      f1
TEST-54-CREDS.sh[1074]:   Stack mid redzone:       f2
TEST-54-CREDS.sh[1074]:   Stack right redzone:     f3
TEST-54-CREDS.sh[1074]:   Stack after return:      f5
TEST-54-CREDS.sh[1074]:   Stack use after scope:   f8
TEST-54-CREDS.sh[1074]:   Global redzone:          f9
TEST-54-CREDS.sh[1074]:   Global init order:       f6
TEST-54-CREDS.sh[1074]:   Poisoned by user:        f7
TEST-54-CREDS.sh[1074]:   Container overflow:      fc
TEST-54-CREDS.sh[1074]:   Array cookie:            ac
TEST-54-CREDS.sh[1074]:   Intra object redzone:    bb
TEST-54-CREDS.sh[1074]:   ASan internal:           fe
TEST-54-CREDS.sh[1074]:   Left alloca redzone:     ca
TEST-54-CREDS.sh[1074]:   Right alloca redzone:    cb

Follow-up for 2c3cbc5c01
2024-12-27 17:28:56 +00:00
.clusterfuzzlite ci: unpin CFLite 2022-04-26 09:13:57 +00:00
.github mkosi: Use tools tree by default 2024-12-20 20:09:35 +01:00
.semaphore Revert "semaphore: skip some tests" 2024-12-13 23:43:28 +00:00
catalog catalog: update Polish translation 2024-11-28 13:03:31 +01:00
coccinelle introduce FOREACH_ELEMENT 2024-04-18 17:39:34 +02:00
docs docs: Explicitly mention ~/.local/bin in section on installing mkosi 2024-12-25 13:54:11 +09:00
factory man: don't suggest using pam_unix.so's use_authtok switch 2024-01-17 23:59:05 +00:00
hwdb.d hwdb: comment out the entry for Logitech MX Keys for Mac 2024-12-21 12:19:08 +00:00
LICENSES boot: Add HWID calculation from SMBIOS strings and matching against a built-in list 2024-11-05 22:29:58 +03:00
man image-discovery: add per-user scope (#35510) 2024-12-20 22:12:35 +01:00
mime creds-util: add a concept of "user-scoped" credentials 2024-01-30 17:07:47 +01:00
mkosi.conf.d mkosi: Use build/ as extra search path by default 2024-12-20 20:09:36 +01:00
mkosi.coverage mkosi: Make sure the /coverage directory exists 2024-12-05 22:03:07 +01:00
mkosi.extra mkosi: move drop-in config for sanitizers 2024-12-10 09:46:29 +09:00
mkosi.extra.common mkosi: Move leak sanitizer supressions file to sanitizers extra tree 2024-12-08 12:55:43 +01:00
mkosi.images mkosi: update opensuse spec repo commit 2024-12-26 13:35:29 +00:00
mkosi.repart mkosi: Switch back to btrfs 2024-08-05 15:00:24 +02:00
mkosi.sanitizers mkosi: drop wrapper for unshare 2024-12-14 17:30:01 +09:00
mkosi.uki-profiles Rework TEST-86-MULTI-PROFILE-UKI 2024-10-21 17:24:14 +02:00
modprobe.d modprobe: set 'ifb numifbs=0' to avoid autocreating ifb0 2024-01-12 23:24:54 +00:00
network network: request non-NULL SSID when a wlan interface is configured as station 2024-07-31 10:06:04 +09:00
po po: Translated using Weblate (Italian) 2024-12-25 13:47:59 +09:00
presets presets: Don't enable systemd-homed-firstboot.service by default 2024-06-08 11:29:55 +01:00
profile.d profile.d: don't bail if $SHELL_* variables are unset 2024-12-11 18:33:41 +00:00
rules.d meson: allow to customize the access mode for tty/pts devices 2024-12-16 21:36:07 +00:00
shell-completion shell-completion: add bash completion for userdbctl (#35720) 2024-12-22 17:24:12 +00:00
src creds: fix use-after-free in varlink interface 2024-12-27 17:28:56 +00:00
sysctl.d sysctl.d: Fix pid_max comment 2023-10-31 13:07:49 +01:00
sysusers.d sysusers.d: lock all system users defined by us 2024-10-29 11:00:13 +01:00
test test: answer 2nd mdadm --create question for compat with new version 2024-12-22 15:43:06 +00:00
tmpfiles.d Revert "link README.logs from tmpfiles.d/legacy.conf only if available" 2024-11-29 14:18:15 +01:00
tools meson: allow to customize the access mode for tty/pts devices 2024-12-16 21:36:07 +00:00
units systemd-homed: Give access to /dev/btrfs-control 2024-12-21 19:15:01 +01:00
xorg xorg/50-systemd-user: add a full license header 2021-10-01 14:45:00 +02:00
.clang-format Improve the formatting by adding AlignArrayOfStructures and setting it to Right(right justify) 2024-03-06 15:24:23 +01:00
.ctags editors: Prevent ctags from following symlinks 2019-02-15 11:01:20 -08:00
.dir-locals.el scripts: use 4 space indentation 2019-04-12 08:30:31 +02:00
.editorconfig editorconfig: add NEWS whitespace configuration 2023-10-26 22:41:03 +01:00
.gitattributes Mark all base64 files as generated 2023-08-16 12:49:45 +02:00
.gitignore Add .venv to gitignore 2024-12-20 15:33:32 +00:00
.mailmap mailmap: fix entries for Tobias Klauser 2024-12-11 13:55:07 +00:00
.packit.yml Revert "packit: temporarily build systemd without BPF stuff" 2024-02-11 16:45:03 +01:00
.pylintrc Add .pylintrc to globally suppress warnings we don't really care about 2023-08-10 18:13:29 +02:00
.vimrc vimrc: explicitly set shiftwidth for the C file type 2023-09-18 13:11:45 +02:00
.ycm_extra_conf.py ycm: add doc string for all the functions in configuration file 2017-11-29 13:21:49 -07:00
LICENSE.GPL2 relicense to LGPLv2.1 (with exceptions) 2012-04-12 00:24:39 +02:00
LICENSE.LGPL2.1 licence: remove references to old FSF address 2012-12-17 11:41:31 +01:00
meson_options.txt meson: allow to customize the access mode for tty/pts devices 2024-12-16 21:36:07 +00:00
meson.build tree-wide: drop inclusion of linux/memfd.h 2024-12-24 16:56:21 +01:00
meson.version meson: update version to 258~devel 2024-12-10 19:30:06 +00:00
mkosi.clangd mkosi.clangd: Fail on command errors 2024-12-20 20:09:36 +01:00
mkosi.clean mkosi: Add missing SPDX line 2024-09-22 15:23:08 +02:00
mkosi.conf mkosi: Use tools tree by default 2024-12-20 20:09:35 +01:00
mkosi.functions mkosi: Move copying packages to the output directory to the postinst script 2024-10-29 11:28:47 +01:00
mkosi.postinst.chroot mkosi: Fix authselect systemd-homed feature name 2024-12-21 21:03:03 +01:00
mypy.ini Move mypy.ini and ruff.toml to top level 2024-11-24 16:47:20 +01:00
NEWS meson: allow to customize the access mode for tty/pts devices 2024-12-16 21:36:07 +00:00
README doc: document new baseline requires memfd_create() 2024-12-17 18:26:15 +01:00
README.md README: drop CentOS CI badges 2024-12-12 11:58:52 +09:00
ruff.toml Move mypy.ini and ruff.toml to top level 2024-11-24 16:47:20 +01:00
TODO image-discovery: add per-user scope (#35510) 2024-12-20 22:12:35 +01:00

README.md

Systemd

System and Service Manager

Semaphore CI 2.0 Build Status
Coverity Scan Status
OSS-Fuzz Status
CIFuzz
CII Best Practices
Fossies codespell report
Weblate
Coverage Status
Packaging status
OpenSSF Scorecard

Details

Most documentation is available on systemd's web site.

Assorted, older, general information about systemd can be found in the systemd Wiki.

Information about build requirements is provided in the README file.

Consult our NEWS file for information about what's new in the most recent systemd versions.

Please see the Code Map for information about this repository's layout and content.

Please see the Hacking guide for information on how to hack on systemd and test your modifications.

Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.

When preparing patches for systemd, please follow our Coding Style Guidelines.

If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel

Stable branches with backported patches are available in the stable repo.

We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack