| Name | CVE-2021-3997 |
| Description | A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1003467 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| systemd (PTS) | bullseye | 247.3-7+deb11u5 | fixed |
| bullseye (security) | 247.3-7+deb11u6 | fixed |
| bookworm | 252.31-1~deb12u1 | fixed |
| sid, trixie | 257~rc3-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| systemd | source | bullseye | 247.3-7 | | | |
| systemd | source | (unstable) | 250.2-1 | | | 1003467 |
Notes
[buster] - systemd <ignored> (Minor issue; not exploitable before upstream commit e535840)
[stretch] - systemd <ignored> (Minor issue; utility segfault; not exploitable before upstream commit e535840, PoC doesn't segfault on stretch)
https://bugzilla.redhat.com/show_bug.cgi?id=2024639
https://github.com/systemd/systemd/pull/22070
https://www.openwall.com/lists/oss-security/2022/01/10/2
Exploitable after (but present before): https://github.com/systemd/systemd/commit/e5358401b5df8d395e99815b7a69b8424887472c (v242-rc1)
PoC still crashes on jessie/215-17+deb8u14
Prerequisite/Preparation: https://github.com/systemd/systemd/commit/3bac86abfa1b1720180840ffb9d06b3d54841c11
Prerequisite/Preparation: https://github.com/systemd/systemd/commit/84ced330020c0bae57bd4628f1f44eec91304e69
Fixed by: https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1