CVE-2020-1712 (published 2020-03-31T17:15Z)

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/systemd/systemd
commit_details: repo_url: https://github.com/systemd/systemd
author: Zbigniew Jędrzejewski-Szmek
author_date: 2020-02-05 09:37:07+01:00
msg: Merge branch 'polkit-ref-count'
repository: repo_url: https://github.com/systemd/systemd
repo_name: systemd/systemd
description: The systemd System and Service Manager 
repo_language: C
owner: systemd
repo_url: https://github.com/systemd/systemd
commit_details: repo_url: https://github.com/systemd/systemd
author: Lennart Poettering
author_date: 2020-01-22 17:05:17+01:00
msg: sd-bus: introduce API for re-enqueuing incoming messages

When authorizing via PolicyKit we want to process incoming method calls
twice: once to process and figure out that we need PK authentication,
and a second time after we aquired PK authentication to actually execute
the operation. With this new call sd_bus_enqueue_for_read() we have a
way to put an incoming message back into the read queue for this
purpose.

This might have other uses too, for example debugging.
repository: repo_url: https://github.com/systemd/systemd
repo_name: systemd/systemd
description: The systemd System and Service Manager 
repo_language: C
owner: systemd
file_changes: filename: libsystemd.sym
change_type: ModificationType.MODIFY
diff: @@ -685,6 +685,7 @@ global:
 
 LIBSYSTEMD_245 {
 global:
+        sd_bus_enqeue_for_read;
         sd_bus_message_dump;
         sd_bus_message_sensitive;
         sd_event_add_child_pidfd;

programming_language: SQL
filename: sd-bus.c
change_type: ModificationType.MODIFY
diff: @@ -4207,3 +4207,27 @@ _public_ int sd_bus_get_close_on_exit(sd_bus *bus) {
 
         return bus->close_on_exit;
 }
+
+_public_ int sd_bus_enqeue_for_read(sd_bus *bus, sd_bus_message *m) {
+        int r;
+
+        assert_return(bus, -EINVAL);
+        assert_return(bus = bus_resolve(bus), -ENOPKG);
+        assert_return(m, -EINVAL);
+        assert_return(m->sealed, -EINVAL);
+        assert_return(!bus_pid_changed(bus), -ECHILD);
+
+        if (!BUS_IS_OPEN(bus->state))
+                return -ENOTCONN;
+
+        /* Re-enqeue a message for reading. This is primarily useful for PolicyKit-style authentication,
+         * where we want accept a message, then determine we need to interactively authenticate the user, and
+         * when we have that process the message again. */
+
+        r = bus_rqueue_make_room(bus);
+        if (r < 0)
+                return r;
+
+        bus->rqueue[bus->rqueue_size++] = bus_message_ref_queued(m, bus);
+        return 0;
+}

programming_language: C
filename: sd-bus.h
change_type: ModificationType.MODIFY
diff: @@ -207,6 +207,7 @@ int sd_bus_process(sd_bus *bus, sd_bus_message **r);
 int sd_bus_process_priority(sd_bus *bus, int64_t max_priority, sd_bus_message **r);
 int sd_bus_wait(sd_bus *bus, uint64_t timeout_usec);
 int sd_bus_flush(sd_bus *bus);
+int sd_bus_enqeue_for_read(sd_bus *bus, sd_bus_message *m);
 
 sd_bus_slot* sd_bus_get_current_slot(sd_bus *bus);
 sd_bus_message* sd_bus_get_current_message(sd_bus *bus);

programming_language: Batchfile
repo_url: https://github.com/systemd/systemd
commit_details: repo_url: https://github.com/systemd/systemd
author: Lennart Poettering
author_date: 2020-01-22 17:07:47+01:00
msg: polkit: when authorizing via PK let's re-resolve callback/userdata instead of caching it

Previously, when doing an async PK query we'd store the original
callback/userdata pair and call it again after the PK request is
complete. This is problematic, since PK queries might be slow and in the
meantime the userdata might be released and re-acquired. Let's avoid
this by always traversing through the message handlers so that we always
re-resolve the callback and userdata pair and thus can be sure it's
up-to-date and properly valid.
repository: repo_url: https://github.com/systemd/systemd
repo_name: systemd/systemd
description: The systemd System and Service Manager 
repo_language: C
owner: systemd
file_changes: filename: bus-polkit.c
change_type: ModificationType.MODIFY
diff: @@ -159,14 +159,13 @@ typedef struct AsyncPolkitQuery {
         char **details;
 
         sd_bus_message *request, *reply;
-        sd_bus_message_handler_t callback;
-        void *userdata;
         sd_bus_slot *slot;
+
         Hashmap *registry;
+        sd_event_source *defer_event_source;
 } AsyncPolkitQuery;
 
 static void async_polkit_query_free(AsyncPolkitQuery *q) {
-
         if (!q)
                 return;
 
@@ -181,9 +180,22 @@ static void async_polkit_query_free(AsyncPolkitQuery *q) {
         free(q->action);
         strv_free(q->details);
 
+        sd_event_source_disable_unref(q->defer_event_source);
         free(q);
 }
 
+static int async_polkit_defer(sd_event_source *s, void *userdata) {
+        AsyncPolkitQuery *q = userdata;
+
+        assert(s);
+
+        /* This is called as idle event source after we processed the async polkit reply, hopefully after the
+         * method call we re-enqueued has been properly processed. */
+
+        async_polkit_query_free(q);
+        return 0;
+}
+
 static int async_polkit_callback(sd_bus_message *reply, void *userdata, sd_bus_error *error) {
         _cleanup_(sd_bus_error_free) sd_bus_error error_buffer = SD_BUS_ERROR_NULL;
         AsyncPolkitQuery *q = userdata;
@@ -192,21 +204,46 @@ static int async_polkit_callback(sd_bus_message *reply, void *userdata, sd_bus_e
         assert(reply);
         assert(q);
 
+        assert(q->slot);
         q->slot = sd_bus_slot_unref(q->slot);
+
+        assert(!q->reply);
         q->reply = sd_bus_message_ref(reply);
 
+        /* Now, let's dispatch the original message a second time be re-enqueing. This will then traverse the
+         * whole message processing again, and thus re-validating and re-retrieving the "userdata" field
+         * again.
+         *
+         * We install an idle event loop event to clean-up the PolicyKit request data when we are idle again,
+         * i.e. after the second time the message is processed is complete. */
+
+        assert(!q->defer_event_source);
+        r = sd_event_add_defer(sd_bus_get_event(sd_bus_message_get_bus(reply)), &q->defer_event_source, async_polkit_defer, q);
+        if (r < 0)
+                goto fail;
+
+        r = sd_event_source_set_priority(q->defer_event_source, SD_EVENT_PRIORITY_IDLE);
+        if (r < 0)
+                goto fail;
+
+        r = sd_event_source_set_enabled(q->defer_event_source, SD_EVENT_ONESHOT);
+        if (r < 0)
+                goto fail;
+
         r = sd_bus_message_rewind(q->request, true);
-        if (r < 0) {
-                r = sd_bus_reply_method_errno(q->request, r, NULL);
-                goto finish;
-        }
+        if (r < 0)
+                goto fail;
+
+        r = sd_bus_enqeue_for_read(sd_bus_message_get_bus(q->request), q->request);
+        if (r < 0)
+                goto fail;
 
-        r = q->callback(q->request, q->userdata, &error_buffer);
-        r = bus_maybe_reply_error(q->request, r, &error_buffer);
+        return 1;
 
-finish:
+fail:
+        log_debug_errno(r, "Processing asynchronous PolicyKit reply failed, ignoring: %m");
+        (void) sd_bus_reply_method_errno(q->request, r, NULL);
         async_polkit_query_free(q);
-
         return r;
 }
 
@@ -225,11 +262,9 @@ int bus_verify_polkit_async(
 #if ENABLE_POLKIT
         _cleanup_(sd_bus_message_unrefp) sd_bus_message *pk = NULL;
         AsyncPolkitQuery *q;
-        const char *sender;
-        sd_bus_message_handler_t callback;
-        void *userdata;
         int c;
 #endif
+        const char *sender;
         int r;
 
         assert(call);
@@ -293,20 +328,11 @@ int bus_verify_polkit_async(
         else if (r > 0)
                 return 1;
 
-#if ENABLE_POLKIT
-        if (sd_bus_get_current_message(call->bus) != call)
-                return -EINVAL;
-
-        callback = sd_bus_get_current_handler(call->bus);
-        if (!callback)
-                return -EINVAL;
-
-        userdata = sd_bus_get_current_userdata(call->bus);
-
         sender = sd_bus_message_get_sender(call);
         if (!sender)
                 return -EBADMSG;
 
+#if ENABLE_POLKIT
         c = sd_bus_message_get_allow_interactive_authorization(call);
         if (c < 0)
                 return c;
@@ -349,8 +375,6 @@ int bus_verify_polkit_async(
 
         *q = (AsyncPolkitQuery) {
                 .request = sd_bus_message_ref(call),
-                .callback = callback,
-                .userdata = userdata,
         };
 
         q->action = strdup(action);

programming_language: C
repo_url: https://github.com/systemd/systemd
commit_details: repo_url: https://github.com/systemd/systemd
author: Zbigniew Jędrzejewski-Szmek
author_date: 2020-02-04 18:39:04+01:00
msg: Fix typo in function name
repository: repo_url: https://github.com/systemd/systemd
repo_name: systemd/systemd
description: The systemd System and Service Manager 
repo_language: C
owner: systemd
file_changes: filename: TODO
change_type: ModificationType.MODIFY
diff: @@ -328,7 +328,7 @@ Features:
 
 * the a-posteriori stopping of units bound to units that disappeared logic
   should be reworked: there should be a queue of units, and we should only
-  enqeue stop jobs from a defer event that processes queue instead of
+  enqueue stop jobs from a defer event that processes queue instead of
   right-away when we find a unit that is bound to one that doesn't exist
   anymore. (similar to how the stop-unneeded queue has been reworked the same
   way)

programming_language: Markdown
filename: sd_bus_enqueue_for_read.xml
change_type: ModificationType.MODIFY
diff: @@ -47,7 +47,7 @@
 
     <para>This call is primarily useful for dealing with incoming method calls that may be processed only
     after an additional asynchronous operation completes. One example are PolicyKit authorization requests
-    that are determined to be necessary to autorize a newly incoming method call: when the PolicyKit response
+    that are determined to be necessary to authorize a newly incoming method call: when the PolicyKit response
     is received the original method call may be re-enqueued to process it again, this time with the
     authorization result known.</para>
   </refsect1>

programming_language: HTML
filename: libsystemd.sym
change_type: ModificationType.MODIFY
diff: @@ -685,7 +685,7 @@ global:
 
 LIBSYSTEMD_245 {
 global:
-        sd_bus_enqeue_for_read;
+        sd_bus_enqueue_for_read;
         sd_bus_message_dump;
         sd_bus_message_sensitive;
         sd_event_add_child_pidfd;

programming_language: SQL
filename: sd-bus.c
change_type: ModificationType.MODIFY
diff: @@ -4208,7 +4208,7 @@ _public_ int sd_bus_get_close_on_exit(sd_bus *bus) {
         return bus->close_on_exit;
 }
 
-_public_ int sd_bus_enqeue_for_read(sd_bus *bus, sd_bus_message *m) {
+_public_ int sd_bus_enqueue_for_read(sd_bus *bus, sd_bus_message *m) {
         int r;
 
         assert_return(bus, -EINVAL);
@@ -4220,9 +4220,9 @@ _public_ int sd_bus_enqeue_for_read(sd_bus *bus, sd_bus_message *m) {
         if (!BUS_IS_OPEN(bus->state))
                 return -ENOTCONN;
 
-        /* Re-enqeue a message for reading. This is primarily useful for PolicyKit-style authentication,
-         * where we want accept a message, then determine we need to interactively authenticate the user, and
-         * when we have that process the message again. */
+        /* Re-enqueue a message for reading. This is primarily useful for PolicyKit-style authentication,
+         * where we accept a message, then determine we need to interactively authenticate the user, and then
+         * we want to process the message again. */
 
         r = bus_rqueue_make_room(bus);
         if (r < 0)

programming_language: C
filename: bus-polkit.c
change_type: ModificationType.MODIFY
diff: @@ -234,7 +234,7 @@ static int async_polkit_callback(sd_bus_message *reply, void *userdata, sd_bus_e
         if (r < 0)
                 goto fail;
 
-        r = sd_bus_enqeue_for_read(sd_bus_message_get_bus(q->request), q->request);
+        r = sd_bus_enqueue_for_read(sd_bus_message_get_bus(q->request), q->request);
         if (r < 0)
                 goto fail;
 

programming_language: C
filename: sd-bus.h
change_type: ModificationType.MODIFY
diff: @@ -207,7 +207,7 @@ int sd_bus_process(sd_bus *bus, sd_bus_message **r);
 int sd_bus_process_priority(sd_bus *bus, int64_t max_priority, sd_bus_message **r);
 int sd_bus_wait(sd_bus *bus, uint64_t timeout_usec);
 int sd_bus_flush(sd_bus *bus);
-int sd_bus_enqeue_for_read(sd_bus *bus, sd_bus_message *m);
+int sd_bus_enqueue_for_read(sd_bus *bus, sd_bus_message *m);
 
 sd_bus_slot* sd_bus_get_current_slot(sd_bus *bus);
 sd_bus_message* sd_bus_get_current_message(sd_bus *bus);

programming_language: Batchfile