It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 4.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade systemd-tests-debuginfoUpgrade systemd-journal-remote-debuginfoUpgrade systemdUpgrade systemd-debugsourceUpgrade systemd-libs-debuginfoUpgrade systemd-pamUpgrade systemd-udevUpgrade systemd-containerUpgrade systemd-testsUpgrade systemd-journal-remoteUpgrade systemd-develUpgrade systemd-container-debuginfoUpgrade systemd-udev-debuginfoUpgrade systemd-debuginfoUpgrade systemd-pam-debuginfoUpgrade systemd-libs | Apr 29, 2020 | Apr 26, 2019 |
| Debian | — | Upgrade systemd | Jul 30, 2024 | Apr 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade systemd-libsUpgrade systemd-develUpgrade systemd-containerUpgrade systemdUpgrade systemd-udevUpgrade systemd-udev-compatUpgrade systemd-pamUpgrade systemd-journal-remote | Jun 27, 2019 | Apr 26, 2019 |
| Oracle_linux | — | Upgrade systemd-udevUpgrade systemd-containerUpgrade systemd-testsUpgrade systemd-libsUpgrade systemd-pamUpgrade systemd-develUpgrade systemdUpgrade systemd-journal-remote | Oct 5, 2022 | Apr 25, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Apr 26, 2019 |
| Redhat_linux | — | Upgrade systemd-testsUpgrade systemd-pam-debuginfoUpgrade systemd-debuginfoUpgrade systemd-udevUpgrade systemd-libsUpgrade systemd-journal-remoteUpgrade systemd-journal-remote-debuginfoUpgrade systemd-container-debuginfoUpgrade systemd-tests-debuginfoUpgrade systemd-develUpgrade systemdUpgrade systemd-debugsourceUpgrade systemd-containerUpgrade systemd-udev-debuginfoUpgrade systemd-libs-debuginfoUpgrade systemd-pam | Apr 29, 2020 | Apr 26, 2019 |
| Suse | — | Upgrade libudev1Upgrade systemd-langUpgrade systemdUpgrade systemd-develUpgrade libsystemd0-32bitUpgrade udevUpgrade systemd-32bitUpgrade systemd-journal-remoteUpgrade libudev-develUpgrade libsystemd0Upgrade systemd-sysvinitUpgrade systemd-docUpgrade systemd-coredumpUpgrade systemd-bash-completionUpgrade systemd-containerUpgrade libudev1-32bit | Feb 4, 2022 | Apr 26, 2019 |
| Ubuntu | — | Upgrade systemd | Feb 6, 2020 | Apr 26, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub