Systemd Serialization Vulnerability
When systemd re-executes (e.g. during a package upgrade), state is serialized into a memfd before the execve(), then reloaded after the execve(). Serialized data is stored as text, with key-value pairs separated by newlines. Values are escaped to prevent control character injection. Lines associated with a systemd unit are read in unit_deserialize() using fgets(): char line[LINE_MAX], *l, *v; [...] if (!fgets(line, sizeof(line), f)) { if (feof(f)) return 0; return -errno; } LINE_MAX is 2048: /usr/include/bits/posix2_lim.h:#define LINE_MAX _POSIX2_LINE_MAX /usr/include/bits/posix2_lim.h:#define _POSIX2_LINE_MAX 2048 When fgets() encounters overlong input, it behaves dangerously. If a line is more than 2047 characters long, fgets() will return the first 2047 characters and leave the read cursor in the middle of the overlong line. Then, when fgets() is called the next time, it continues to read data from offset 2047 in the line as if a new line started there. Therefore, if an attacker can inject an overlong value into the serialized state somehow, it is possible to inject extra key-value pairs into the serialized state. A service that has `NotifyAccess != none` can send a status message to systemd that will be stored as a property of the service. When systemd re-executes, this status message is stored under the key "status-text". Status messages that are sent to systemd are received by manager_dispatch_notify_fd(). This function has a receive buffer of size NOTIFY_BUFFER_MAX==PIPE_BUF==4096. Therefore, a service with `NotifyAccess != none` can trigger this bug.
