It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 4.4
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade systemd-sysvUpgrade systemd-networkdUpgrade systemd-debuginfoUpgrade libgudev1Upgrade systemd-develUpgrade systemd-libsUpgrade systemd-resolvedUpgrade libgudev1-develUpgrade systemdUpgrade systemd-pythonUpgrade systemd-journal-gateway | Aug 28, 2019 | Jan 14, 2019 |
| Debian | — | Upgrade systemd | Jul 30, 2024 | Jan 14, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade systemd-pythonUpgrade systemd-develUpgrade systemdUpgrade libgudev1Upgrade systemd-sysvUpgrade systemd-libsUpgrade libgudev1-devel | Dec 4, 2019 | Jan 14, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libgudev1Upgrade systemd-develUpgrade systemdUpgrade systemd-pythonUpgrade libgudev1-develUpgrade systemd-libsUpgrade systemd-sysv | Dec 18, 2019 | Jan 14, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade systemd-sysvUpgrade systemdUpgrade libgudev1-develUpgrade systemd-udev-compatUpgrade systemd-develUpgrade systemd-libsUpgrade libgudev1Upgrade systemd-python | Nov 19, 2019 | Jan 14, 2019 |
| Oracle_linux | — | Upgrade systemd-pythonUpgrade libgudev1Upgrade systemd-develUpgrade systemdUpgrade systemd-sysvUpgrade systemd-libsUpgrade systemd-journal-gatewayUpgrade systemd-resolvedUpgrade systemd-networkdUpgrade libgudev1-devel | Jul 21, 2020 | Aug 17, 2017 |
| Redhat_linux | — | Upgrade systemd-debuginfoUpgrade systemd-pythonUpgrade systemd-sysvUpgrade systemd-networkdUpgrade libgudev1Upgrade libgudev1-develUpgrade systemdUpgrade systemd-libsUpgrade systemd-journal-gatewayUpgrade systemd-resolvedUpgrade systemd-devel | Aug 7, 2019 | Jan 14, 2019 |
| Ubuntu | — | Upgrade systemd | Feb 6, 2020 | Jan 14, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub