PT-2018-2737 · Systemd+5 · Systemd+5

Pedro Sampaio · Published 2017-07-17 · Updated 2022-01-31 · CVE-2018-1049

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions systemd versions prior to 234

Description The issue is related to a race condition between .mount and .automount units in systemd. This condition may cause the kernel to hold a mountpoint, leading to processes hanging when trying to use the mount. The race condition can result in a denial of service until the mount points are unmounted. The vulnerability is also described as being related to the simultaneous use of a shared resource and synchronization errors, which can be exploited by a remote attacker to cause a denial of service.

Recommendations For versions prior to 234, update to version 234 or later to resolve the issue. At the moment, there is no other information about additional mitigation measures for this vulnerability.

Fix

DoS

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALT-PU-2017-1893

BDU:2019-01640

CESA-2018_0260

CVE-2018-1049

DLA-1580-1

MGASA-2018-0094

RHSA-2018:0260

RHSA-2018_0260

SUSE-SU-2018:0299-1

USN-3558-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Systemd

References · 62

• https://bdu.fstec.ru/vul/2019-01640 · Security Note
• https://ubuntu.com/security/notices/USN-3558-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0299-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000082 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1049 · Security Note
• https://osv.dev/vulnerability/MGASA-2018-0094 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3558-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15908 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9445 · Security Note
• https://ubuntu.com/security/CVE-2018-1049 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2018-0260.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1049 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1534701 · Patch
• https://access.redhat.com/errata/RHSA-2018:0260 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory