It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 4.4
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade systemd-journal-gatewayUpgrade libgudev1-develUpgrade systemd-pythonUpgrade systemdUpgrade systemd-sysvUpgrade systemd-debuginfoUpgrade systemd-develUpgrade systemd-libsUpgrade libgudev1Upgrade systemd-resolvedUpgrade systemd-networkd | Aug 28, 2019 | Jan 14, 2019 |
| Debian | — | Upgrade systemd | Jul 30, 2024 | Jan 14, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade systemd-pythonUpgrade systemd-develUpgrade systemdUpgrade libgudev1Upgrade systemd-sysvUpgrade libgudev1-develUpgrade systemd-libs | Dec 4, 2019 | Jan 14, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libgudev1-develUpgrade systemd-libsUpgrade systemd-sysvUpgrade systemd-pythonUpgrade systemdUpgrade systemd-develUpgrade libgudev1 | Dec 18, 2019 | Jan 14, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade systemd-pythonUpgrade systemd-libsUpgrade systemd-develUpgrade libgudev1Upgrade systemdUpgrade systemd-sysvUpgrade libgudev1-develUpgrade systemd-udev-compat | Nov 19, 2019 | Jan 14, 2019 |
| Oracle_linux | — | Upgrade systemd-journal-gatewayUpgrade systemd-resolvedUpgrade libgudev1-develUpgrade systemd-networkdUpgrade systemd-libsUpgrade systemd-sysvUpgrade libgudev1Upgrade systemd-develUpgrade systemdUpgrade systemd-python | Jul 21, 2020 | Aug 17, 2017 |
| Redhat_linux | — | Upgrade systemd-debuginfoUpgrade libgudev1Upgrade systemd-sysvUpgrade systemdUpgrade systemd-pythonUpgrade libgudev1-develUpgrade systemd-networkdUpgrade systemd-journal-gatewayUpgrade systemd-develUpgrade systemd-resolvedUpgrade systemd-libs | Aug 7, 2019 | Jan 14, 2019 |
| Ubuntu | — | Upgrade systemd | Feb 6, 2020 | Jan 14, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub