Security update for systemd, dracut SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:1898-1 Final 1 1 2017-07-19T09:13:10Z current 2017-07-19T09:13:10Z 2017-07-19T09:13:10Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for systemd, dracut This update for systemd and dracut fixes the following issues: Security issues fixed: - CVE-2017-9445: Possible out-of-bounds write triggered by a specially crafted TCP payload from a DNS server. (bsc#1045290) Non-security issues fixed in systemd: - Automounter issue in combination with NFS volumes (bsc#1040968) - Missing symbolic link for SAS device in /dev/disk/by-path (bsc#1040153) - Add minimal support for boot.d/* scripts in systemd-sysv-convert (bsc#1046750) Non-security issues fixed in dracut: - Bail out if module directory does not exist. (bsc#1043900) - Suppress bogus error message. (bsc#1032029) - Fix module force loading with systemd. (bsc#986216) - Ship udev files required by systemd. (bsc#1040153) - Ignore module resolution errors (e.g. with kgraft). (bsc#1037120) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-1174,SUSE-SLE-DESKTOP-12-SP2-2017-1174,SUSE-SLE-RPI-12-SP2-2017-1174,SUSE-SLE-SDK-12-SP2-2017-1174,SUSE-SLE-SERVER-12-SP2-2017-1174 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20171898-1/ Link for SUSE-SU-2017:1898-1 https://lists.opensuse.org/opensuse-security-announce/2017-07/msg00028.html E-Mail link for SUSE-SU-2017:1898-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1032029 SUSE Bug 1032029 https://bugzilla.suse.com/1033238 SUSE Bug 1033238 https://bugzilla.suse.com/1037120 SUSE Bug 1037120 https://bugzilla.suse.com/1040153 SUSE Bug 1040153 https://bugzilla.suse.com/1040968 SUSE Bug 1040968 https://bugzilla.suse.com/1043900 SUSE Bug 1043900 https://bugzilla.suse.com/1045290 SUSE Bug 1045290 https://bugzilla.suse.com/1046750 SUSE Bug 1046750 https://bugzilla.suse.com/986216 SUSE Bug 986216 https://www.suse.com/security/cve/CVE-2017-9445/ SUSE CVE CVE-2017-9445 page SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP2 dracut-044.1-109.8.3 libsystemd0-228-150.7.1 libsystemd0-32bit-228-150.7.1 libudev1-228-150.7.1 libudev1-32bit-228-150.7.1 systemd-228-150.7.1 systemd-32bit-228-150.7.1 systemd-bash-completion-228-150.7.1 systemd-sysvinit-228-150.7.1 udev-228-150.7.1 dracut-fips-044.1-109.8.3 libudev-devel-228-150.7.1 systemd-devel-228-150.7.1 dracut-044.1-109.8.3 as a component of SUSE Linux Enterprise Desktop 12 SP2 libsystemd0-228-150.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libsystemd0-32bit-228-150.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libudev1-228-150.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libudev1-32bit-228-150.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 systemd-228-150.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 systemd-32bit-228-150.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 systemd-bash-completion-228-150.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 systemd-sysvinit-228-150.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 udev-228-150.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 dracut-044.1-109.8.3 as a component of SUSE Linux Enterprise Server 12 SP2 dracut-fips-044.1-109.8.3 as a component of SUSE Linux Enterprise Server 12 SP2 libsystemd0-228-150.7.1 as a component of SUSE Linux Enterprise Server 12 SP2 libsystemd0-32bit-228-150.7.1 as a component of SUSE Linux Enterprise Server 12 SP2 libudev1-228-150.7.1 as a component of SUSE Linux Enterprise Server 12 SP2 libudev1-32bit-228-150.7.1 as a component of SUSE Linux Enterprise Server 12 SP2 systemd-228-150.7.1 as a component of SUSE Linux Enterprise Server 12 SP2 systemd-32bit-228-150.7.1 as a component of SUSE Linux Enterprise Server 12 SP2 systemd-bash-completion-228-150.7.1 as a component of SUSE Linux Enterprise Server 12 SP2 systemd-sysvinit-228-150.7.1 as a component of SUSE Linux Enterprise Server 12 SP2 udev-228-150.7.1 as a component of SUSE Linux Enterprise Server 12 SP2 dracut-044.1-109.8.3 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 dracut-fips-044.1-109.8.3 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 libsystemd0-228-150.7.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 libudev1-228-150.7.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 systemd-228-150.7.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 systemd-bash-completion-228-150.7.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 systemd-sysvinit-228-150.7.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 udev-228-150.7.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 dracut-044.1-109.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 dracut-fips-044.1-109.8.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libsystemd0-228-150.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libsystemd0-32bit-228-150.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libudev1-228-150.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libudev1-32bit-228-150.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 systemd-228-150.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 systemd-32bit-228-150.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 systemd-bash-completion-228-150.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 systemd-sysvinit-228-150.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 udev-228-150.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libudev-devel-228-150.7.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 systemd-devel-228-150.7.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it. CVE-2017-9445 SUSE Linux Enterprise Desktop 12 SP2:dracut-044.1-109.8.3 SUSE Linux Enterprise Desktop 12 SP2:libsystemd0-228-150.7.1 SUSE Linux Enterprise Desktop 12 SP2:libsystemd0-32bit-228-150.7.1 SUSE Linux Enterprise Desktop 12 SP2:libudev1-228-150.7.1 SUSE Linux Enterprise Desktop 12 SP2:libudev1-32bit-228-150.7.1 SUSE Linux Enterprise Desktop 12 SP2:systemd-228-150.7.1 SUSE Linux Enterprise Desktop 12 SP2:systemd-32bit-228-150.7.1 SUSE Linux Enterprise Desktop 12 SP2:systemd-bash-completion-228-150.7.1 SUSE Linux Enterprise Desktop 12 SP2:systemd-sysvinit-228-150.7.1 SUSE Linux Enterprise Desktop 12 SP2:udev-228-150.7.1 SUSE Linux Enterprise Server 12 SP2:dracut-044.1-109.8.3 SUSE Linux Enterprise Server 12 SP2:dracut-fips-044.1-109.8.3 SUSE Linux Enterprise Server 12 SP2:libsystemd0-228-150.7.1 SUSE Linux Enterprise Server 12 SP2:libsystemd0-32bit-228-150.7.1 SUSE Linux Enterprise Server 12 SP2:libudev1-228-150.7.1 SUSE Linux Enterprise Server 12 SP2:libudev1-32bit-228-150.7.1 SUSE Linux Enterprise Server 12 SP2:systemd-228-150.7.1 SUSE Linux Enterprise Server 12 SP2:systemd-32bit-228-150.7.1 SUSE Linux Enterprise Server 12 SP2:systemd-bash-completion-228-150.7.1 SUSE Linux Enterprise Server 12 SP2:systemd-sysvinit-228-150.7.1 SUSE Linux Enterprise Server 12 SP2:udev-228-150.7.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:dracut-044.1-109.8.3 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:dracut-fips-044.1-109.8.3 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libsystemd0-228-150.7.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libudev1-228-150.7.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:systemd-228-150.7.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:systemd-bash-completion-228-150.7.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:systemd-sysvinit-228-150.7.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:udev-228-150.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:dracut-044.1-109.8.3 SUSE Linux Enterprise Server for SAP Applications 12 SP2:dracut-fips-044.1-109.8.3 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsystemd0-228-150.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libsystemd0-32bit-228-150.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libudev1-228-150.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libudev1-32bit-228-150.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:systemd-228-150.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:systemd-32bit-228-150.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:systemd-bash-completion-228-150.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:systemd-sysvinit-228-150.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:udev-228-150.7.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libudev-devel-228-150.7.1 SUSE Linux Enterprise Software Development Kit 12 SP2:systemd-devel-228-150.7.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171898-1/ https://www.suse.com/security/cve/CVE-2017-9445.html CVE-2017-9445 https://bugzilla.suse.com/1045290 SUSE Bug 1045290 https://bugzilla.suse.com/1063249 SUSE Bug 1063249