CVE-2015-8842

Debian Bug report logs - #825059
CVE-2015-8842

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2015-8842

Date: Mon, 23 May 2016 09:49:38 +0200

Package: systemd
Version: 215-17+deb8u4
Severity: important
Tags: security patch

As discussed on IRC it would be great if CVE-2015-8842 could be fixed
in a jessie point release. Please see here for further links:
https://security-tracker.debian.org/tracker/CVE-2015-8842

Cheers,
        Moritz

Message #14 received at 825059@bugs.debian.org (full text, mbox, reply):

From: Michael Biebl <biebl@debian.org>

To: 825059@bugs.debian.org, Moritz Muehlenhoff <jmm@debian.org>

Subject: Re: CVE-2015-8842

Date: Fri, 1 Jul 2016 17:28:11 +0200

[Message part 1 (text/plain, inline)]

Hi Moritz

On Mon, 23 May 2016 09:49:38 +0200 Moritz Muehlenhoff <jmm@debian.org>
wrote:
> Package: systemd
> Version: 215-17+deb8u4
> Severity: important
> Tags: security patch
> 
> As discussed on IRC it would be great if CVE-2015-8842 could be fixed
> in a jessie point release. Please see here for further links:
> https://security-tracker.debian.org/tracker/CVE-2015-8842

I looked into this today.
The faulty commit was introduced in v213 by the commit referenced in the
security tracker.
There was a followup commit in v214:

commit 176f2acf8dee45fee832fd2ab07243f63783a238
Author: Lennart Poettering <lennart@poettering.net>
Date:   Wed Jun 11 10:23:16 2014 +0200

    tmpfiles: don't allow read access to journal files to users not in
systemd-journal

    Also, don't apply access mode recursively to /var/log/journal/*/, since
    that might be quite large, and should be correct anyway.


This means, users who installed jessie from scratch and never had 214-1
installed, won't be affected.

Only if a (unstable) user had /var/log/journal enabled and 214-1
installed in the past, he might end up with a systemd.journal which has
the wrong permissions.
The commit [1] basically fixes up borked permissions of existing
system.journal files. And if he's an (up-to-date) unstable user, he has
already received the update in 230-1.

So, considering this, I don't think this will be an issue in practice
and I think we can safely close this issue.

Waiting for your confirmation though, before doing so.

Regards,
Michael

[1]
https://github.com/systemd/systemd/commit/afae249efa4774c6676738ac5de6aeb4daf4889f

-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

[signature.asc (application/pgp-signature, attachment)]

Message #19 received at 825059-done@bugs.debian.org (full text, mbox, reply):

From: Michael Biebl <biebl@debian.org>

To: 825059-done@bugs.debian.org, Moritz Muehlenhoff <jmm@debian.org>

Subject: Re: CVE-2015-8842

Date: Sun, 3 Jul 2016 15:13:32 +0200

[Message part 1 (text/plain, inline)]

Version: 215-1

Am 01.07.2016 um 17:28 schrieb Michael Biebl:
> This means, users who installed jessie from scratch and never had 214-1
> installed, won't be affected.

Or upgraded directly from wheezy to jessie

> Only if a (unstable) user had /var/log/journal enabled and 214-1
> installed in the past, he might end up with a systemd.journal which has
> the wrong permissions.
> The commit [1] basically fixes up borked permissions of existing
> system.journal files. And if he's an (up-to-date) unstable user, he has
> already received the update in 230-1.
> 
> So, considering this, I don't think this will be an issue in practice
> and I think we can safely close this issue.
> 
> Waiting for your confirmation though, before doing so.

After further consideration, I'm going to close this bug report.
The offending tmpfiles snippet was removed in 215, so we don't really
need the fixup from v229.

Moritz, can you mark the issue accordingly in the security tracker?

Regards,
Michael
-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

[signature.asc (application/pgp-signature, attachment)]

Message #24 received at 825059@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 825059@bugs.debian.org

Cc: Moritz Muehlenhoff <jmm@debian.org>, Michael Biebl <biebl@debian.org>

Subject: CVE-2014-9770 vs CVE-2015-8842

Date: Sun, 3 Jul 2016 17:47:05 +0200

Hi Michael,

On Sun, Jul 03, 2016 at 01:15:15PM +0000, Debian Bug Tracking System wrote:
> After further consideration, I'm going to close this bug report.
> The offending tmpfiles snippet was removed in 215, so we don't really
> need the fixup from v229.
> 
> Moritz, can you mark the issue accordingly in the security tracker?

I though think we are mixing two CVEs here. The commit you references
for 214 was assigned a different CVE:

Cf. CVE-2014-9770 vs. CVE-2015-8842.

But I have added a note additionally to the no-dsa that it does not
affect jessie installations in practice to the security-tracker notes. 

Review welcome :-)

For referene the two CVE (which though are related):

https://security-tracker.debian.org/CVE-2014-9770
https://security-tracker.debian.org/CVE-2015-8842

It's a bit complex how MITRE has assigned the CVEs to the SuSE request
possibly. But the commits referenced for the two should reflect the
original assingment at
https://marc.info/?l=oss-security&m=146031729006090&w=2

Regards,
Salvatore

Message #33 received at 825059@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: Michael Biebl <biebl@debian.org>

Cc: 825059@bugs.debian.org

Subject: Re: CVE-2015-8842

Date: Wed, 13 Jul 2016 10:56:57 +0200

On Sun, Jul 03, 2016 at 03:13:32PM +0200, Michael Biebl wrote:
> Version: 215-1
> 
> Am 01.07.2016 um 17:28 schrieb Michael Biebl:
> > This means, users who installed jessie from scratch and never had 214-1
> > installed, won't be affected.
> 
> Or upgraded directly from wheezy to jessie
> 
> > Only if a (unstable) user had /var/log/journal enabled and 214-1
> > installed in the past, he might end up with a systemd.journal which has
> > the wrong permissions.
> > The commit [1] basically fixes up borked permissions of existing
> > system.journal files. And if he's an (up-to-date) unstable user, he has
> > already received the update in 230-1.
> > 
> > So, considering this, I don't think this will be an issue in practice
> > and I think we can safely close this issue.
> > 
> > Waiting for your confirmation though, before doing so.
> 
> After further consideration, I'm going to close this bug report.
> The offending tmpfiles snippet was removed in 215, so we don't really
> need the fixup from v229.
> 
> Moritz, can you mark the issue accordingly in the security tracker?

Confirmed. I have upgraded the security tracker.

Cheers,
        Moritz

Send a report that this bug log contains spam.