PT-2019-6159 · Systemd+6 · Systemd+6
Jann Horn
·
Publicado
2019-04-19
·
Atualizado
2024-06-15
·
CVE-2019-3844
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
systemd (affected versions not specified)
Description
The issue is related to a systemd service that utilizes the DynamicUser property, allowing it to gain new privileges through the execution of SUID binaries. This could enable a local attacker to create binaries owned by the service's transient group with the setgid bit set, potentially accessing resources that will be owned by a different service in the future when the GID is recycled. The vulnerability is associated with incorrect privilege assignment, which may allow an attacker to access confidential data, compromise its integrity, and cause a denial of service.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Centos
Red Hat
Suse
Ubuntu
Systemd