Merge ~enr0n/ubuntu/+source/systemd:ubuntu-kinetic-sru into ~ubuntu-core-dev/ubuntu/+source/systemd:ubuntu-kinetic

[Nick Rosbrook]

PPA: https://launchpad.net/~enr0n/+archive/ubuntu/systemd-251/+packages?field.name_filter=systemd&field.status_filter=published

These autopkgtest results are from a previous build, i.e. before rebasing on the security update. The networkd-test.py failure is already present and will not be considered a regression. The unit-tests failure in armhf is fixed in my latest build, though I did not re-trigger the autopkgtest because it was a known issue, and I just forgot to include the fix in the tested build.

systemd 251.4-1ubuntu7.1~ppa3 (arm64) -- Fail: https://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-enr0n-systemd-251/kinetic/arm64/s/systemd/20230302_125651_41ba8@/log.gz
systemd 251.4-1ubuntu7.1~ppa3 (armhf) -- Fail: https://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-enr0n-systemd-251/kinetic/armhf/s/systemd/20230302_052203_41ba8@/log.gz
systemd 251.4-1ubuntu7.1~ppa3 (ppc64el) -- Fail: https://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-enr0n-systemd-251/kinetic/ppc64el/s/systemd/20230301_230404_11ba2@/log.gz
systemd 251.4-1ubuntu7.1~ppa3 (s390x) -- Fail: https://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-enr0n-systemd-251/kinetic/s390x/s/systemd/20230302_003917_11ba2@/log.gz
systemd 251.4-1ubuntu7.1~ppa4 (amd64) -- Fail: https://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-enr0n-systemd-251/kinetic/amd64/s/systemd/20230303_021808_57da3@/log.gz

[Lukas Märdian (slyon)]

Thanks for the explanation about the test failures. Apparently networkd-test.py regressed in release, which is bad but seems unrelated to the systemd package:

"There is an autopkgtest failure currently in kinetic (not considered a regression) that seems to be caused by a kernel change. I am not exactly sure what change broke the test, but if I run the test in a fresh kinetic install (nothing from -updates installed yet), the test passes. But if I install just the new kernel from -updates, the test fails." -- enr0n

Do we already have a tracking bug report about that ^ issue? Could you please reference it here and escalate it to the corresponding (Kernel?) team? Having systemd autopkgtests failing in a stable series is not a good position to be in and we should try to get it fixed soon (by the corresponding team).

Your changes/patches to systemd packaging itself LGTM!

review: Approve

[Lukas Märdian (slyon)]

https://launchpad.net/ubuntu/kinetic/+queue?queue_state=1&queue_text=systemd

[Nick Rosbrook (enr0n)]

I have opened bug 2009859 to track the issue.

diff --git a/debian/changelog b/debian/changelog
index c7ddcfc..2fe2841 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,34 @@
+systemd (251.4-1ubuntu7.2) kinetic; urgency=medium
+
+  * network/dhcp4: accept local subnet routes from DHCP (LP: #2004478)
+    File: debian/patches/lp2004478-network-dhcp4-accept-local-subnet-routes-from-DHCP.patch
+    https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=751bac59b405025964d76c4ef8e0603457a605af
+  * udev: avoid NIC renaming race with kernel (LP: #2002445)
+    Files:
+    - debian/patches/lp2002445/sd-netlink-add-a-test-for-rtnl_set_link_name.patch
+    - debian/patches/lp2002445/sd-netlink-do-not-swap-old-name-and-alternative-name.patch
+    - debian/patches/lp2002445/sd-netlink-restore-altname-on-error-in-rtnl_set_link_name.patch
+    - debian/patches/lp2002445/udev-attempt-device-rename-even-if-interface-is-up.patch
+    - debian/patches/lp2002445/udev-net-allow-new-link-name-as-an-altname-before-renamin.patch
+    https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=ffb1e85fdd3f0fe9b158b28a95cfa6d241fcbe70
+
+ -- Nick Rosbrook <[e-mail]>  Wed, 08 Mar 2023 12:07:55 -0500
+
+systemd (251.4-1ubuntu7.1) kinetic-security; urgency=medium
+
+  * SECURITY UPDATE: information leak vulnerability in systemd-coredump
+    - debian/patches/CVE-2022-4415.patch: do not allow user to access
+      coredumps with changed uid/gid/capabilities
+    - CVE-2022-4415
+  * SECURITY UPDATE: DoS vulnerability in systemd-coredump
+    - debian/patches/backport-for-CVE-2022-45873.patch: allow
+      json_variant_dump() to return an error
+    - debian/patches/CVE-2022-45873.patch: avoid deadlock when passing
+      processed backtrace data
+    - CVE-2022-45873
+
+ -- Nishit Majithia <[e-mail]>  Thu, 02 Mar 2023 18:28:02 +0530
+
 systemd (251.4-1ubuntu7) kinetic; urgency=medium
 
   [ Nick Rosbrook ]
diff --git a/debian/patches/CVE-2022-4415.patch b/debian/patches/CVE-2022-4415.patch
 new file mode 100644
index 0000000..cc12be9
--- /dev/null
+++ b/debian/patches/CVE-2022-4415.patch
@@ -0,0 +1,380 @@
+ Origin: backport, https://github.com/systemd/systemd-stable/commit/efca5283dc791a07171f80eef84e14fdb58fad57
+
+From efca5283dc791a07171f80eef84e14fdb58fad57 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <[e-mail]>
+Date: Mon, 28 Nov 2022 12:12:55 +0100
+Subject: [PATCH] coredump: do not allow user to access coredumps with changed
+ uid/gid/capabilities
+
+When the user starts a program which elevates its permissions via setuid,
+setgid, or capabilities set on the file, it may access additional information
+which would then be visible in the coredump. We shouldn't make the the coredump
+visible to the user in such cases.
+
+Reported-by: Matthias Gerstner <[e-mail]>
+
+This reads the /proc/<pid>/auxv file and attaches it to the process metadata as
+PROC_AUXV. Before the coredump is submitted, it is parsed and if either
+at_secure was set (which the kernel will do for processes that are setuid,
+setgid, or setcap), or if the effective uid/gid don't match uid/gid, the file
+is not made accessible to the user. If we can't access this data, we assume the
+file should not be made accessible either. In principle we could also access
+the auxv data from a note in the core file, but that is much more complex and
+it seems better to use the stand-alone file that is provided by the kernel.
+
+Attaching auxv is both convient for this patch (because this way it's passed
+between the stages along with other fields), but I think it makes sense to save
+it in general.
+
+We use the information early in the core file to figure out if the program was
+32-bit or 64-bit and its endianness. This way we don't need heuristics to guess
+whether the format of the auxv structure. This test might reject some cases on
+fringe architecutes. But the impact would be limited: we just won't grant the
+user permissions to view the coredump file. If people report that we're missing
+some cases, we can always enhance this to support more architectures.
+
+I tested auxv parsing on amd64, 32-bit program on amd64, arm64, arm32, and
+ppc64el, but not the whole coredump handling.
+
+(cherry picked from commit 3e4d0f6cf99f8677edd6a237382a65bfe758de03)
+(cherry picked from commit 9b75a3d0502d6741c8ecb7175794345f8eb3827c)
+---
+ src/basic/io-util.h     |   9 ++
+ src/coredump/coredump.c | 196 +++++++++++++++++++++++++++++++++++++---
+ 2 files changed, 192 insertions(+), 13 deletions(-)
+
+--- systemd-251.4.orig/src/basic/io-util.h
++++ systemd-251.4/src/basic/io-util.h
+@@ -91,7 +91,16 @@ struct iovec_wrapper *iovw_new(void);
+ struct iovec_wrapper *iovw_free(struct iovec_wrapper *iovw);
+ struct iovec_wrapper *iovw_free_free(struct iovec_wrapper *iovw);
+ void iovw_free_contents(struct iovec_wrapper *iovw, bool free_vectors);
++
+ int iovw_put(struct iovec_wrapper *iovw, void *data, size_t len);
++static inline int iovw_consume(struct iovec_wrapper *iovw, void *data, size_t len) {
++        /* Move data into iovw or free on error */
++        int r = iovw_put(iovw, data, len);
++        if (r < 0)
++                free(data);
++        return r;
++}
++
+ int iovw_put_string_field(struct iovec_wrapper *iovw, const char *field, const char *value);
+ int iovw_put_string_field_free(struct iovec_wrapper *iovw, const char *field, char *value);
+ void iovw_rebase(struct iovec_wrapper *iovw, char *old, char *new);
+--- systemd-251.4.orig/src/coredump/coredump.c
++++ systemd-251.4/src/coredump/coredump.c
+@@ -4,6 +4,7 @@
+ #include <stdio.h>
+ #include <sys/prctl.h>
+ #include <sys/statvfs.h>
++#include <sys/auxv.h>
+ #include <sys/xattr.h>
+ #include <unistd.h>
+ 
+@@ -105,6 +106,7 @@ enum {
+ 
+         META_EXE = _META_MANDATORY_MAX,
+         META_UNIT,
++        META_PROC_AUXV,
+         _META_MAX
+ };
+ 
+@@ -119,10 +121,12 @@ static const char * const meta_field_nam
+         [META_COMM]              = "COREDUMP_COMM=",
+         [META_EXE]               = "COREDUMP_EXE=",
+         [META_UNIT]              = "COREDUMP_UNIT=",
++        [META_PROC_AUXV]         = "COREDUMP_PROC_AUXV=",
+ };
+ 
+ typedef struct Context {
+         const char *meta[_META_MAX];
++        size_t meta_size[_META_MAX];
+         pid_t pid;
+         bool is_pid1;
+         bool is_journald;
+@@ -184,13 +188,16 @@ static uint64_t storage_size_max(void) {
+         return 0;
+ }
+ 
+-static int fix_acl(int fd, uid_t uid) {
++static int fix_acl(int fd, uid_t uid, bool allow_user) {
++        assert(fd >= 0);
++        assert(uid_is_valid(uid));
+ 
+ #if HAVE_ACL
+         int r;
+ 
+-        assert(fd >= 0);
+-        assert(uid_is_valid(uid));
++        /* We don't allow users to read coredumps if the uid or capabilities were changed. */
++        if (!allow_user)
++                return 0;
+ 
+         if (uid_is_system(uid) || uid_is_dynamic(uid) || uid == UID_NOBODY)
+                 return 0;
+@@ -250,7 +257,8 @@ static int fix_permissions(
+                 const char *filename,
+                 const char *target,
+                 const Context *context,
+-                uid_t uid) {
++                uid_t uid,
++                bool allow_user) {
+ 
+         int r;
+ 
+@@ -260,7 +268,7 @@ static int fix_permissions(
+ 
+         /* Ignore errors on these */
+         (void) fchmod(fd, 0640);
+-        (void) fix_acl(fd, uid);
++        (void) fix_acl(fd, uid, allow_user);
+         (void) fix_xattr(fd, context);
+ 
+         r = fsync_full(fd);
+@@ -330,6 +338,153 @@ static int make_filename(const Context *
+         return 0;
+ }
+ 
++static int parse_auxv64(
++                const uint64_t *auxv,
++                size_t size_bytes,
++                int *at_secure,
++                uid_t *uid,
++                uid_t *euid,
++                gid_t *gid,
++                gid_t *egid) {
++
++        assert(auxv || size_bytes == 0);
++
++        if (size_bytes % (2 * sizeof(uint64_t)) != 0)
++                return log_warning_errno(SYNTHETIC_ERRNO(EIO), "Incomplete auxv structure (%zu bytes).", size_bytes);
++
++        size_t words = size_bytes / sizeof(uint64_t);
++
++        /* Note that we set output variables even on error. */
++
++        for (size_t i = 0; i + 1 < words; i += 2)
++                switch (auxv[i]) {
++                case AT_SECURE:
++                        *at_secure = auxv[i + 1] != 0;
++                        break;
++                case AT_UID:
++                        *uid = auxv[i + 1];
++                        break;
++                case AT_EUID:
++                        *euid = auxv[i + 1];
++                        break;
++                case AT_GID:
++                        *gid = auxv[i + 1];
++                        break;
++                case AT_EGID:
++                        *egid = auxv[i + 1];
++                        break;
++                case AT_NULL:
++                        if (auxv[i + 1] != 0)
++                                goto error;
++                        return 0;
++                }
++ error:
++        return log_warning_errno(SYNTHETIC_ERRNO(ENODATA),
++                                 "AT_NULL terminator not found, cannot parse auxv structure.");
++}
++
++static int parse_auxv32(
++                const uint32_t *auxv,
++                size_t size_bytes,
++                int *at_secure,
++                uid_t *uid,
++                uid_t *euid,
++                gid_t *gid,
++                gid_t *egid) {
++
++        assert(auxv || size_bytes == 0);
++
++        size_t words = size_bytes / sizeof(uint32_t);
++
++        if (size_bytes % (2 * sizeof(uint32_t)) != 0)
++                return log_warning_errno(SYNTHETIC_ERRNO(EIO), "Incomplete auxv structure (%zu bytes).", size_bytes);
++
++        /* Note that we set output variables even on error. */
++
++        for (size_t i = 0; i + 1 < words; i += 2)
++                switch (auxv[i]) {
++                case AT_SECURE:
++                        *at_secure = auxv[i + 1] != 0;
++                        break;
++                case AT_UID:
++                        *uid = auxv[i + 1];
++                        break;
++                case AT_EUID:
++                        *euid = auxv[i + 1];
++                        break;
++                case AT_GID:
++                        *gid = auxv[i + 1];
++                        break;
++                case AT_EGID:
++                        *egid = auxv[i + 1];
++                        break;
++                case AT_NULL:
++                        if (auxv[i + 1] != 0)
++                                goto error;
++                        return 0;
++                }
++ error:
++        return log_warning_errno(SYNTHETIC_ERRNO(ENODATA),
++                                 "AT_NULL terminator not found, cannot parse auxv structure.");
++}
++
++static int grant_user_access(int core_fd, const Context *context) {
++        int at_secure = -1;
++        uid_t uid = UID_INVALID, euid = UID_INVALID;
++        uid_t gid = GID_INVALID, egid = GID_INVALID;
++        int r;
++
++        assert(core_fd >= 0);
++        assert(context);
++
++        if (!context->meta[META_PROC_AUXV])
++                return log_warning_errno(SYNTHETIC_ERRNO(ENODATA), "No auxv data, not adjusting permissions.");
++
++        uint8_t elf[EI_NIDENT];
++        errno = 0;
++        if (pread(core_fd, &elf, sizeof(elf), 0) != sizeof(elf))
++                return log_warning_errno(errno_or_else(EIO),
++                                         "Failed to pread from coredump fd: %s", errno != 0 ? strerror_safe(errno) : "Unexpected EOF");
++
++        if (elf[EI_MAG0] != ELFMAG0 ||
++            elf[EI_MAG1] != ELFMAG1 ||
++            elf[EI_MAG2] != ELFMAG2 ||
++            elf[EI_MAG3] != ELFMAG3 ||
++            elf[EI_VERSION] != EV_CURRENT)
++                return log_info_errno(SYNTHETIC_ERRNO(EUCLEAN),
++                                      "Core file does not have ELF header, not adjusting permissions.");
++        if (!IN_SET(elf[EI_CLASS], ELFCLASS32, ELFCLASS64) ||
++            !IN_SET(elf[EI_DATA], ELFDATA2LSB, ELFDATA2MSB))
++                return log_info_errno(SYNTHETIC_ERRNO(EUCLEAN),
++                                      "Core file has strange ELF class, not adjusting permissions.");
++
++        if ((elf[EI_DATA] == ELFDATA2LSB) != (__BYTE_ORDER == __LITTLE_ENDIAN))
++                return log_info_errno(SYNTHETIC_ERRNO(EUCLEAN),
++                                      "Core file has non-native endianness, not adjusting permissions.");
++
++        if (elf[EI_CLASS] == ELFCLASS64)
++                r = parse_auxv64((const uint64_t*) context->meta[META_PROC_AUXV],
++                                 context->meta_size[META_PROC_AUXV],
++                                 &at_secure, &uid, &euid, &gid, &egid);
++        else
++                r = parse_auxv32((const uint32_t*) context->meta[META_PROC_AUXV],
++                                 context->meta_size[META_PROC_AUXV],
++                                 &at_secure, &uid, &euid, &gid, &egid);
++        if (r < 0)
++                return r;
++
++        /* We allow access if we got all the data and at_secure is not set and
++         * the uid/gid matches euid/egid. */
++        bool ret =
++                at_secure == 0 &&
++                uid != UID_INVALID && euid != UID_INVALID && uid == euid &&
++                gid != GID_INVALID && egid != GID_INVALID && gid == egid;
++        log_debug("Will %s access (uid="UID_FMT " euid="UID_FMT " gid="GID_FMT " egid="GID_FMT " at_secure=%s)",
++                  ret ? "permit" : "restrict",
++                  uid, euid, gid, egid, yes_no(at_secure));
++        return ret;
++}
++
+ static int save_external_coredump(
+                 const Context *context,
+                 int input_fd,
+@@ -452,6 +607,8 @@ static int save_external_coredump(
+                                 context->meta[META_ARGV_PID], context->meta[META_COMM]);
+         truncated = r == 1;
+ 
++        bool allow_user = grant_user_access(fd, context) > 0;
++
+ #if HAVE_COMPRESSION
+         if (arg_compress) {
+                 _cleanup_(unlink_and_freep) char *tmp_compressed = NULL;
+@@ -489,7 +646,7 @@ static int save_external_coredump(
+                         uncompressed_size += partial_uncompressed_size;
+                 }
+ 
+-                r = fix_permissions(fd_compressed, tmp_compressed, fn_compressed, context, uid);
++                r = fix_permissions(fd_compressed, tmp_compressed, fn_compressed, context, uid, allow_user);
+                 if (r < 0)
+                         return r;
+ 
+@@ -516,7 +673,7 @@ static int save_external_coredump(
+                            "SIZE_LIMIT=%"PRIu64, max_size,
+                            "MESSAGE_ID=" SD_MESSAGE_TRUNCATED_CORE_STR);
+ 
+-        r = fix_permissions(fd, tmp, fn, context, uid);
++        r = fix_permissions(fd, tmp, fn, context, uid, allow_user);
+         if (r < 0)
+                 return log_error_errno(r, "Failed to fix permissions and finalize coredump %s into %s: %m", coredump_tmpfile_name(tmp), fn);
+ 
+@@ -764,7 +921,7 @@ static int change_uid_gid(const Context
+ }
+ 
+ static int submit_coredump(
+-                Context *context,
++                const Context *context,
+                 struct iovec_wrapper *iovw,
+                 int input_fd) {
+ 
+@@ -925,16 +1082,15 @@ static int save_context(Context *context
+                 struct iovec *iovec = iovw->iovec + n;
+ 
+                 for (size_t i = 0; i < ELEMENTSOF(meta_field_names); i++) {
+-                        char *p;
+-
+                         /* Note that these strings are NUL terminated, because we made sure that a
+                          * trailing NUL byte is in the buffer, though not included in the iov_len
+                          * count (see process_socket() and gather_pid_metadata_*()) */
+                         assert(((char*) iovec->iov_base)[iovec->iov_len] == 0);
+ 
+-                        p = startswith(iovec->iov_base, meta_field_names[i]);
++                        const char *p = startswith(iovec->iov_base, meta_field_names[i]);
+                         if (p) {
+                                 context->meta[i] = p;
++                                context->meta_size[i] = iovec->iov_len - strlen(meta_field_names[i]);
+                                 count++;
+                                 break;
+                         }
+@@ -1176,6 +1332,7 @@ static int gather_pid_metadata(struct io
+         uid_t owner_uid;
+         pid_t pid;
+         char *t;
++        size_t size;
+         const char *p;
+         int r;
+ 
+@@ -1240,13 +1397,26 @@ static int gather_pid_metadata(struct io
+                 (void) iovw_put_string_field_free(iovw, "COREDUMP_PROC_LIMITS=", t);
+ 
+         p = procfs_file_alloca(pid, "cgroup");
+-        if (read_full_virtual_file(p, &t, NULL) >=0)
++        if (read_full_virtual_file(p, &t, NULL) >= 0)
+                 (void) iovw_put_string_field_free(iovw, "COREDUMP_PROC_CGROUP=", t);
+ 
+         p = procfs_file_alloca(pid, "mountinfo");
+-        if (read_full_virtual_file(p, &t, NULL) >=0)
++        if (read_full_virtual_file(p, &t, NULL) >= 0)
+                 (void) iovw_put_string_field_free(iovw, "COREDUMP_PROC_MOUNTINFO=", t);
+ 
++        /* We attach /proc/auxv here. ELF coredumps also contain a note for this (NT_AUXV), see elf(5). */
++        p = procfs_file_alloca(pid, "auxv");
++        if (read_full_virtual_file(p, &t, &size) >= 0) {
++                char *buf = malloc(strlen("COREDUMP_PROC_AUXV=") + size + 1);
++                if (buf) {
++                        /* Add a dummy terminator to make save_context() happy. */
++                        *((uint8_t*) mempcpy(stpcpy(buf, "COREDUMP_PROC_AUXV="), t, size)) = '\0';
++                        (void) iovw_consume(iovw, buf, size + strlen("COREDUMP_PROC_AUXV="));
++                }
++
++                free(t);
++        }
++
+         if (get_process_cwd(pid, &t) >= 0)
+                 (void) iovw_put_string_field_free(iovw, "COREDUMP_CWD=", t);
+ 
diff --git a/debian/patches/CVE-2022-45873.patch b/debian/patches/CVE-2022-45873.patch
 new file mode 100644
index 0000000..2badbcb
--- /dev/null
+++ b/debian/patches/CVE-2022-45873.patch
@@ -0,0 +1,115 @@
+From 076b807be472630692c5348c60d0c2b7b28ad437 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <[e-mail]>
+Date: Tue, 18 Oct 2022 18:23:53 +0200
+Subject: [PATCH] coredump: avoid deadlock when passing processed backtrace
+ data
+
+We would deadlock when passing the data back from the forked-off process that
+was doing backtrace generation back to the coredump parent. This is because we
+fork the child and wait for it to exit. The child tries to write too much data
+to the output pipe, and and after the first 64k blocks on the parent because
+the pipe is full. The bug surfaced in Fedora because of a combination of four
+factors:
+- 87707784c70dc9894ec613df0a6e75e732a362a3 was backported to v251.5, which
+  allowed coredump processing to be successful.
+- 1a0281a3ebf4f8c16d40aa9e63103f16cd23bb2a was NOT backported, so the output
+  was very verbose.
+- Fedora has the ELF package metadata available, so a lot of output can be
+  generated. Most other distros just don't have the information.
+- gnome-calendar crashes and has a bazillion modules and 69596 bytes of output
+  are generated for it.
+
+Fixes https://bugzilla.redhat.com/show_bug.cgi?id=2135778.
+
+The code is changed to try to write data opportunistically. If we get partial
+information, that is still logged. In is generally better to log partial
+backtrace information than nothing at all.
+---
+ src/shared/elf-util.c | 37 +++++++++++++++++++++++++++++++------
+ 1 file changed, 31 insertions(+), 6 deletions(-)
+
+--- systemd-251.4.orig/src/shared/elf-util.c
++++ systemd-251.4/src/shared/elf-util.c
+@@ -30,6 +30,9 @@
+ #define THREADS_MAX 64
+ #define ELF_PACKAGE_METADATA_ID 0xcafe1a7e
+ 
++/* The amount of data we're willing to write to each of the output pipes. */
++#define COREDUMP_PIPE_MAX (1024*1024U)
++
+ static void *dw_dl = NULL;
+ static void *elf_dl = NULL;
+ 
+@@ -704,13 +707,13 @@ int parse_elf_object(int fd, const char
+                 return r;
+ 
+         if (ret) {
+-                r = RET_NERRNO(pipe2(return_pipe, O_CLOEXEC));
++                r = RET_NERRNO(pipe2(return_pipe, O_CLOEXEC|O_NONBLOCK));
+                 if (r < 0)
+                         return r;
+         }
+ 
+         if (ret_package_metadata) {
+-                r = RET_NERRNO(pipe2(json_pipe, O_CLOEXEC));
++                r = RET_NERRNO(pipe2(json_pipe, O_CLOEXEC|O_NONBLOCK));
+                 if (r < 0)
+                         return r;
+         }
+@@ -754,8 +757,24 @@ int parse_elf_object(int fd, const char
+                         goto child_fail;
+ 
+                 if (buf) {
+-                        r = loop_write(return_pipe[1], buf, strlen(buf), false);
+-                        if (r < 0)
++                        size_t len = strlen(buf);
++
++                        if (len > COREDUMP_PIPE_MAX) {
++                                /* This is iffy. A backtrace can be a few hundred kilobytes, but too much is
++                                 * too much. Let's log a warning and ignore the rest. */
++                                log_warning("Generated backtrace is %zu bytes (more than the limit of %u bytes), backtrace will be truncated.",
++                                            len, COREDUMP_PIPE_MAX);
++                                len = COREDUMP_PIPE_MAX;
++                        }
++
++                        /* Bump the space for the returned string.
++                         * Failure is ignored, because partial output is still useful. */
++                        (void) fcntl(return_pipe[1], F_SETPIPE_SZ, len);
++
++                        r = loop_write(return_pipe[1], buf, len, false);
++                        if (r == -EAGAIN)
++                                log_warning("Write failed, backtrace will be truncated.");
++                        else if (r < 0)
+                                 goto child_fail;
+ 
+                         return_pipe[1] = safe_close(return_pipe[1]);
+@@ -764,13 +783,19 @@ int parse_elf_object(int fd, const char
+                 if (package_metadata) {
+                         _cleanup_fclose_ FILE *json_out = NULL;
+ 
++                        /* Bump the space for the returned string. We don't know how much space we'll need in
++                         * advance, so we'll just try to write as much as possible and maybe fail later. */
++                        (void) fcntl(json_pipe[1], F_SETPIPE_SZ, COREDUMP_PIPE_MAX);
++
+                         json_out = take_fdopen(&json_pipe[1], "w");
+                         if (!json_out) {
+                                 r = -errno;
+                                 goto child_fail;
+                         }
+ 
+-                        json_variant_dump(package_metadata, JSON_FORMAT_FLUSH, json_out, NULL);
++                        r = json_variant_dump(package_metadata, JSON_FORMAT_FLUSH, json_out, NULL);
++                        if (r < 0)
++                                log_warning_errno(r, "Failed to write JSON package metadata, ignoring: %m");
+                 }
+ 
+                 _exit(EXIT_SUCCESS);
+@@ -805,7 +830,7 @@ int parse_elf_object(int fd, const char
+ 
+                 r = json_parse_file(json_in, NULL, 0, &package_metadata, NULL, NULL);
+                 if (r < 0 && r != -EINVAL) /* EINVAL: json was empty, so we got nothing, but that's ok */
+-                        return r;
++                        log_warning_errno(r, "Failed to read or parse json metadata, ignoring: %m");
+         }
+ 
+         if (ret)
diff --git a/debian/patches/backport-for-CVE-2022-45873.patch b/debian/patches/backport-for-CVE-2022-45873.patch
 new file mode 100644
index 0000000..857fd1d
--- /dev/null
+++ b/debian/patches/backport-for-CVE-2022-45873.patch
@@ -0,0 +1,45 @@
+From 7922ead507e0d83e4ec72a8cbd2b67194766e58c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <[e-mail]>
+Date: Tue, 18 Oct 2022 18:09:06 +0200
+Subject: [PATCH] shared/json: allow json_variant_dump() to return an error
+
+---
+ src/shared/json.c | 7 ++++---
+ src/shared/json.h | 2 +-
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+--- systemd-251.4.orig/src/shared/json.c
++++ systemd-251.4/src/shared/json.c
+@@ -1770,9 +1770,9 @@ int json_variant_format(JsonVariant *v,
+         return (int) sz - 1;
+ }
+ 
+-void json_variant_dump(JsonVariant *v, JsonFormatFlags flags, FILE *f, const char *prefix) {
++int json_variant_dump(JsonVariant *v, JsonFormatFlags flags, FILE *f, const char *prefix) {
+         if (!v)
+-                return;
++                return 0;
+ 
+         if (!f)
+                 f = stdout;
+@@ -1798,7 +1798,8 @@ void json_variant_dump(JsonVariant *v, J
+                 fputc('\n', f); /* In case of SSE add a second newline */
+ 
+         if (flags & JSON_FORMAT_FLUSH)
+-                fflush(f);
++                return fflush_and_check(f);
++        return 0;
+ }
+ 
+ int json_variant_filter(JsonVariant **v, char **to_remove) {
+--- systemd-251.4.orig/src/shared/json.h
++++ systemd-251.4/src/shared/json.h
+@@ -195,7 +195,7 @@ typedef enum JsonFormatFlags {
+ } JsonFormatFlags;
+ 
+ int json_variant_format(JsonVariant *v, JsonFormatFlags flags, char **ret);
+-void json_variant_dump(JsonVariant *v, JsonFormatFlags flags, FILE *f, const char *prefix);
++int json_variant_dump(JsonVariant *v, JsonFormatFlags flags, FILE *f, const char *prefix);
+ 
+ int json_variant_filter(JsonVariant **v, char **to_remove);
+ 
diff --git a/debian/patches/lp2002445/sd-netlink-add-a-test-for-rtnl_set_link_name.patch b/debian/patches/lp2002445/sd-netlink-add-a-test-for-rtnl_set_link_name.patch
 new file mode 100644
index 0000000..382f6ea
--- /dev/null
+++ b/debian/patches/lp2002445/sd-netlink-add-a-test-for-rtnl_set_link_name.patch
@@ -0,0 +1,66 @@
+From: Nick Rosbrook <[e-mail]>
+Date: Tue, 22 Nov 2022 17:01:47 -0500
+Subject: sd-netlink: add a test for rtnl_set_link_name()
+
+Origin: upstream, https://github.com/systemd/systemd/commit/b338a8bb40
+Bug-Ubuntu: https://launchpad.net/bugs/2002445
+
+Add a test that verifies a deleted alternative name is restored on error
+in rtnl_set_link_name().
+---
+ src/libsystemd/sd-netlink/test-netlink.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/src/libsystemd/sd-netlink/test-netlink.c b/src/libsystemd/sd-netlink/test-netlink.c
+index fbc3ef0..440e9ce 100644
+--- a/src/libsystemd/sd-netlink/test-netlink.c
++++ b/src/libsystemd/sd-netlink/test-netlink.c
+@@ -8,6 +8,7 @@
+ #include <linux/if_macsec.h>
+ #include <linux/l2tp.h>
+ #include <linux/nl80211.h>
++#include <unistd.h>
+ 
+ #include "sd-netlink.h"
+ 
+@@ -666,6 +667,32 @@ static void test_genl(void) {
+         }
+ }
+ 
++static void test_rtnl_set_link_name(sd_netlink *rtnl, int ifindex) {
++        _cleanup_strv_free_ char **alternative_names = NULL;
++        int r;
++
++        log_debug("/* %s */", __func__);
++
++        if (geteuid() != 0)
++                return (void) log_tests_skipped("not root");
++
++        /* Test that the new name (which is currently an alternative name) is
++         * restored as an alternative name on error. Create an error by using
++         * an invalid device name, namely one that exceeds IFNAMSIZ
++         * (alternative names can exceed IFNAMSIZ, but not regular names). */
++        r = rtnl_set_link_alternative_names(&rtnl, ifindex, STRV_MAKE("testlongalternativename"));
++        if (r == -EPERM)
++                return (void) log_tests_skipped("missing required capabilities");
++        if (r == -EOPNOTSUPP)
++                return (void) log_tests_skipped("alternative name is not supported");
++
++        assert_se(r >= 0);
++        assert_se(rtnl_set_link_name(&rtnl, ifindex, "testlongalternativename") == -EINVAL);
++        assert_se(rtnl_get_link_alternative_names(&rtnl, ifindex, &alternative_names) >= 0);
++        assert_se(strv_contains(alternative_names, "testlongalternativename"));
++        assert_se(rtnl_delete_link_alternative_names(&rtnl, ifindex, STRV_MAKE("testlongalternativename")) >= 0);
++}
++
+ int main(void) {
+         sd_netlink *rtnl;
+         sd_netlink_message *m;
+@@ -697,6 +724,7 @@ int main(void) {
+         test_pipe(if_loopback);
+         test_event_loop(if_loopback);
+         test_link_configure(rtnl, if_loopback);
++        test_rtnl_set_link_name(rtnl, if_loopback);
+ 
+         test_get_addresses(rtnl);
+         test_message_link_bridge(rtnl);
diff --git a/debian/patches/lp2002445/sd-netlink-do-not-swap-old-name-and-alternative-name.patch b/debian/patches/lp2002445/sd-netlink-do-not-swap-old-name-and-alternative-name.patch
 new file mode 100644
index 0000000..2cf4997
--- /dev/null
+++ b/debian/patches/lp2002445/sd-netlink-do-not-swap-old-name-and-alternative-name.patch
@@ -0,0 +1,54 @@
+From: Nick Rosbrook <[e-mail]>
+Date: Fri, 2 Dec 2022 15:26:18 -0500
+Subject: sd-netlink: do not swap old name and alternative name
+
+Origin: upstream, https://github.com/systemd/systemd/commit/080afbb57c
+Bug-Ubuntu: https://launchpad.net/bugs/2002445
+
+Commit 434a348380 ("netlink: do not fail when new interface name is
+already used as an alternative name") added logic to set the old
+interface name as an alternative name, but only when the new name is
+currently an alternative name. This is not the desired outcome in most
+cases, and the important part of this commit was to delete the new name
+from the list of alternative names if necessary.
+---
+ src/libsystemd/sd-netlink/netlink-util.c | 12 ------------
+ 1 file changed, 12 deletions(-)
+
+diff --git a/src/libsystemd/sd-netlink/netlink-util.c b/src/libsystemd/sd-netlink/netlink-util.c
+index ce2c4f3..f88169e 100644
+--- a/src/libsystemd/sd-netlink/netlink-util.c
++++ b/src/libsystemd/sd-netlink/netlink-util.c
+@@ -12,7 +12,6 @@
+ int rtnl_set_link_name(sd_netlink **rtnl, int ifindex, const char *name) {
+         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *message = NULL;
+         _cleanup_strv_free_ char **alternative_names = NULL;
+-        char old_name[IF_NAMESIZE] = {};
+         int r;
+ 
+         assert(rtnl);
+@@ -32,10 +31,6 @@ int rtnl_set_link_name(sd_netlink **rtnl, int ifindex, const char *name) {
+                 if (r < 0)
+                         return log_debug_errno(r, "Failed to remove '%s' from alternative names on network interface %i: %m",
+                                                name, ifindex);
+-
+-                r = format_ifname(ifindex, old_name);
+-                if (r < 0)
+-                        return log_debug_errno(r, "Failed to get current name of network interface %i: %m", ifindex);
+         }
+ 
+         r = sd_rtnl_message_new_link(*rtnl, &message, RTM_SETLINK, ifindex);
+@@ -50,13 +45,6 @@ int rtnl_set_link_name(sd_netlink **rtnl, int ifindex, const char *name) {
+         if (r < 0)
+                 return r;
+ 
+-        if (!isempty(old_name)) {
+-                r = rtnl_set_link_alternative_names(rtnl, ifindex, STRV_MAKE(old_name));
+-                if (r < 0)
+-                        log_debug_errno(r, "Failed to set '%s' as an alternative name on network interface %i, ignoring: %m",
+-                                        old_name, ifindex);
+-        }
+-
+         return 0;
+ }
+ 
diff --git a/debian/patches/lp2002445/sd-netlink-restore-altname-on-error-in-rtnl_set_link_name.patch b/debian/patches/lp2002445/sd-netlink-restore-altname-on-error-in-rtnl_set_link_name.patch
 new file mode 100644
index 0000000..a5e2e24
--- /dev/null
+++ b/debian/patches/lp2002445/sd-netlink-restore-altname-on-error-in-rtnl_set_link_name.patch
@@ -0,0 +1,64 @@
+From: Nick Rosbrook <[e-mail]>
+Date: Wed, 2 Nov 2022 05:36:14 -0400
+Subject: sd-netlink: restore altname on error in rtnl_set_link_name
+
+Origin: upstream, https://github.com/systemd/systemd/commit/4d600667f8
+Bug-Ubuntu: https://launchpad.net/bugs/2002445
+
+If a current alternative name is to be used to rename a network
+interface, the alternative name must be removed first. If interface
+renaming fails, restore the alternative name that was deleted if
+necessary.
+---
+ src/libsystemd/sd-netlink/netlink-util.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/src/libsystemd/sd-netlink/netlink-util.c b/src/libsystemd/sd-netlink/netlink-util.c
+index 7f2596d..c4ead31 100644
+--- a/src/libsystemd/sd-netlink/netlink-util.c
++++ b/src/libsystemd/sd-netlink/netlink-util.c
+@@ -11,6 +11,7 @@
+ int rtnl_set_link_name(sd_netlink **rtnl, int ifindex, const char *name) {
+         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *message = NULL;
+         _cleanup_strv_free_ char **alternative_names = NULL;
++        bool altname_deleted = false;
+         int r;
+ 
+         assert(rtnl);
+@@ -30,21 +31,33 @@ int rtnl_set_link_name(sd_netlink **rtnl, int ifindex, const char *name) {
+                 if (r < 0)
+                         return log_debug_errno(r, "Failed to remove '%s' from alternative names on network interface %i: %m",
+                                                name, ifindex);
++
++                altname_deleted = true;
+         }
+ 
+         r = sd_rtnl_message_new_link(*rtnl, &message, RTM_SETLINK, ifindex);
+         if (r < 0)
+-                return r;
++                goto fail;
+ 
+         r = sd_netlink_message_append_string(message, IFLA_IFNAME, name);
+         if (r < 0)
+-                return r;
++                goto fail;
+ 
+         r = sd_netlink_call(*rtnl, message, 0, NULL);
+         if (r < 0)
+-                return r;
++                goto fail;
+ 
+         return 0;
++
++fail:
++        if (altname_deleted) {
++                int q = rtnl_set_link_alternative_names(rtnl, ifindex, STRV_MAKE(name));
++                if (q < 0)
++                        log_debug_errno(q, "Failed to restore '%s' as an alternative name on network interface %i, ignoring: %m",
++                                        name, ifindex);
++        }
++
++        return r;
+ }
+ 
+ int rtnl_set_link_properties(
diff --git a/debian/patches/lp2002445/udev-attempt-device-rename-even-if-interface-is-up.patch b/debian/patches/lp2002445/udev-attempt-device-rename-even-if-interface-is-up.patch
 new file mode 100644
index 0000000..5ffc818
--- /dev/null
+++ b/debian/patches/lp2002445/udev-attempt-device-rename-even-if-interface-is-up.patch
@@ -0,0 +1,61 @@
+From: Nick Rosbrook <[e-mail]>
+Date: Fri, 2 Dec 2022 15:35:25 -0500
+Subject: udev: attempt device rename even if interface is up
+
+Origin: upstream, https://github.com/systemd/systemd/commit/53584e7b61
+Bug-Ubuntu: https://launchpad.net/bugs/2002445
+
+Currently rename_netif() will not attempt to rename a device if it is
+already up, because the kernel will return -EBUSY unless live renaming
+is allowed on the device. This restriction will be removed in a future
+kernel version [1].
+
+To cover both cases, always attempt to rename the interface and return 0
+if we get -EBUSY.
+
+[1] https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=bd039b5ea2a9
+---
+ src/udev/udev-event.c | 16 +++++-----------
+ 1 file changed, 5 insertions(+), 11 deletions(-)
+
+diff --git a/src/udev/udev-event.c b/src/udev/udev-event.c
+index 9b53105..681aa87 100644
+--- a/src/udev/udev-event.c
++++ b/src/udev/udev-event.c
+@@ -871,7 +871,6 @@ int udev_event_spawn(
+ static int rename_netif(UdevEvent *event) {
+         const char *oldname;
+         sd_device *dev;
+-        unsigned flags;
+         int ifindex, r;
+ 
+         assert(event);
+@@ -905,16 +904,6 @@ static int rename_netif(UdevEvent *event) {
+                 return 0;
+         }
+ 
+-        r = rtnl_get_link_info(&event->rtnl, ifindex, NULL, &flags, NULL, NULL, NULL);
+-        if (r < 0)
+-                return log_device_warning_errno(dev, r, "Failed to get link flags: %m");
+-
+-        if (FLAGS_SET(flags, IFF_UP)) {
+-                log_device_info(dev, "Network interface '%s' is already up, refusing to rename to '%s'.",
+-                                oldname, event->name);
+-                return 0;
+-        }
+-
+         /* Set ID_RENAMING boolean property here, and drop it in the corresponding move uevent later. */
+         r = device_add_property(dev, "ID_RENAMING", "1");
+         if (r < 0)
+@@ -936,6 +925,11 @@ static int rename_netif(UdevEvent *event) {
+                 return log_device_debug_errno(event->dev_db_clone, r, "Failed to update database under /run/udev/data/: %m");
+ 
+         r = rtnl_set_link_name(&event->rtnl, ifindex, event->name);
++        if (r == -EBUSY) {
++                log_device_info(dev, "Network interface '%s' is already up, cannot rename to '%s'.",
++                                oldname, event->name);
++                return 0;
++        }
+         if (r < 0)
+                 return log_device_error_errno(dev, r, "Failed to rename network interface %i from '%s' to '%s': %m",
+                                               ifindex, oldname, event->name);
diff --git a/debian/patches/lp2002445/udev-net-allow-new-link-name-as-an-altname-before-renamin.patch b/debian/patches/lp2002445/udev-net-allow-new-link-name-as-an-altname-before-renamin.patch
 new file mode 100644
index 0000000..0d651a2
--- /dev/null
+++ b/debian/patches/lp2002445/udev-net-allow-new-link-name-as-an-altname-before-renamin.patch
@@ -0,0 +1,34 @@
+From: Nick Rosbrook <[e-mail]>
+Date: Wed, 2 Nov 2022 11:05:01 -0400
+Subject: udev/net: allow new link name as an altname before renaming happens
+
+Origin: upstream, https://github.com/systemd/systemd/commit/d0b31efc1a
+Bug-Ubuntu: https://launchpad.net/bugs/2002445
+
+When configuring a link's alternative names, the link's new name to-be
+is not allowed to be included because interface renaming will fail if
+the new name is already present as an alternative name. However,
+rtnl_set_link_name will delete the conflicting alternative name before
+renaming the device, if necessary.
+
+Allow the new link name to be set as an alternative name before the
+device is renamed. This means that if the rename is later skipped (i.e.
+because the link is already up), then the name can at least still be
+present as an alternative name.
+---
+ src/udev/net/link-config.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/src/udev/net/link-config.c b/src/udev/net/link-config.c
+index 28c0e63..cdad078 100644
+--- a/src/udev/net/link-config.c
++++ b/src/udev/net/link-config.c
+@@ -844,8 +844,6 @@ static int link_apply_alternative_names(Link *link, sd_netlink **rtnl) {
+                         }
+                 }
+ 
+-        if (link->new_name)
+-                strv_remove(altnames, link->new_name);
+         strv_remove(altnames, link->ifname);
+ 
+         r = rtnl_get_link_alternative_names(rtnl, link->ifindex, &current_altnames);
diff --git a/debian/patches/lp2004478-network-dhcp4-accept-local-subnet-routes-from-DHCP.patch b/debian/patches/lp2004478-network-dhcp4-accept-local-subnet-routes-from-DHCP.patch
 new file mode 100644
index 0000000..6bc3b3c
--- /dev/null
+++ b/debian/patches/lp2004478-network-dhcp4-accept-local-subnet-routes-from-DHCP.patch
@@ -0,0 +1,54 @@
+From: Tuetuopay <[e-mail]>
+Date: Fri, 27 Jan 2023 15:10:49 +0100
+Subject: network/dhcp4: accept local subnet routes from DHCP
+
+Origin: upstream, https://github.com/systemd/systemd/commit/1d84a3c7792a8910b05904937c703307ca19740f
+Bug-Ubuntu: https://launchpad.net/bugs/2004478
+
+RFC3442 specifies option 121 (Classless Static Routes) that allow a DHCP
+server to push arbitrary routes to a client. It has a Local Subnet
+Routes section expliciting the behavior of routes with a null (0.0.0.0)
+gateway.
+
+Such routes are to be installed on the interface with a Link scope, to
+mark them as directly available on the link without any gateway.
+
+Networkd currently drops those routes, which is against the RFC, as
+Linux has proper support for such routes.
+
+Fixes: 7f20627 ("network: dhcp4: ignore gateway in static routes if destination is link-local or in the same network")
+---
+ src/network/networkd-dhcp4.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/src/network/networkd-dhcp4.c b/src/network/networkd-dhcp4.c
+index 0941ad0..7b1133e 100644
+--- a/src/network/networkd-dhcp4.c
++++ b/src/network/networkd-dhcp4.c
+@@ -376,15 +376,18 @@ static int dhcp4_request_route_auto(
+                 route->gw = IN_ADDR_NULL;
+                 route->prefsrc.in = address;
+ 
+-        } else {
+-                if (in4_addr_is_null(gw)) {
+-                        log_link_debug(link, "DHCP: requested route destination "IPV4_ADDRESS_FMT_STR"/%u is not in the assigned network "
+-                                       IPV4_ADDRESS_FMT_STR"/%u, but no gateway is specified, ignoring.",
+-                                       IPV4_ADDRESS_FMT_VAL(route->dst.in), route->dst_prefixlen,
+-                                       IPV4_ADDRESS_FMT_VAL(prefix), prefixlen);
+-                        return 0;
+-                }
++        } else if (in4_addr_is_null(gw)) {
++                log_link_debug(link, "DHCP: requested route destination "IPV4_ADDRESS_FMT_STR"/%u is not in the assigned network "
++                               IPV4_ADDRESS_FMT_STR"/%u, but no gateway is specified, using 'link' scope.",
++                               IPV4_ADDRESS_FMT_VAL(route->dst.in), route->dst_prefixlen,
++                               IPV4_ADDRESS_FMT_VAL(prefix), prefixlen);
+ 
++                route->scope = RT_SCOPE_LINK;
++                route->gw_family = AF_UNSPEC;
++                route->gw = IN_ADDR_NULL;
++                route->prefsrc.in = address;
++
++        } else {
+                 r = dhcp4_request_route_to_gateway(link, gw);
+                 if (r < 0)
+                         return r;
diff --git a/debian/patches/series b/debian/patches/series
index 5b33e52..24359ad 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -52,3 +52,12 @@ lp1981042-core-firstboot-workaround-timezone-issues-caused-by-Ubunt.patch
 test-denylist-TEST-29-PORTABLE-again.patch
 lp1989969-test-deny-list-TEST-36-NUMAPOLICY-on-ppc64el.patch
 lp1991829-add-CAP_LINUX_IMMUTABLE-to-systemd-machined-so-it-ca.patch
+CVE-2022-4415.patch
+backport-for-CVE-2022-45873.patch
+CVE-2022-45873.patch
+lp2004478-network-dhcp4-accept-local-subnet-routes-from-DHCP.patch
+lp2002445/udev-net-allow-new-link-name-as-an-altname-before-renamin.patch
+lp2002445/sd-netlink-do-not-swap-old-name-and-alternative-name.patch
+lp2002445/sd-netlink-restore-altname-on-error-in-rtnl_set_link_name.patch
+lp2002445/udev-attempt-device-rename-even-if-interface-is-up.patch
+lp2002445/sd-netlink-add-a-test-for-rtnl_set_link_name.patch