PT-2019-5811 · Red Hat+1 · Systemd-Journald+2

Riccardo Schirone · Published 2019-01-16 · Updated 2023-02-12 · CVE-2019-3815

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Linux versions since v219-62.2

Description A memory leak was discovered in the backport of fixes in Red Hat Enterprise Linux. The function dispatch message real() in journald-server.c does not free the memory allocated by set iovec field free() to store the CMDLINE= entry. A local attacker may use this flaw to make systemd-journald crash, resulting in a denial of service.

Recommendations For versions since v219-62.2, update to a version that includes the fix for the memory leak issue in the dispatch message real() function. As a temporary workaround, consider restricting access to the systemd-journald service to minimize the risk of exploitation.

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2021-03015

CESA-2019_0201

CVE-2019-3815

DLA-1711-1

RHSA-2019:0201

RHSA-2019_0201

Affected Products

Centos

Red Hat

Systemd-Journald

References · 10

• https://access.redhat.com/errata/RHSA-2019:0201 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3815 · Security Note
• https://osv.dev/vulnerability/DLA-1711-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3815 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2019:0327 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03015 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3815 · Vendor Advisory
• https://github.com/systemd/systemd/issues/12118 · Note
• https://lists.debian.org/debian-lts-announce/2019/03/msg00013.html · Note
• http://securityfocus.com/bid/106632 · Note