It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 4.4
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade systemd-sysvUpgrade systemd-develUpgrade systemd-networkdUpgrade systemd-resolvedUpgrade systemd-libsUpgrade libgudev1Upgrade systemd-debuginfoUpgrade systemd-pythonUpgrade systemdUpgrade systemd-journal-gatewayUpgrade libgudev1-devel | Aug 28, 2019 | Jan 14, 2019 |
| Debian | — | Upgrade systemd | Jul 30, 2024 | Jan 14, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade systemd-develUpgrade libgudev1Upgrade systemdUpgrade systemd-pythonUpgrade libgudev1-develUpgrade systemd-libsUpgrade systemd-sysv | Dec 4, 2019 | Jan 14, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libgudev1Upgrade systemd-develUpgrade systemdUpgrade systemd-pythonUpgrade systemd-libsUpgrade systemd-sysvUpgrade libgudev1-devel | Dec 18, 2019 | Jan 14, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade systemd-pythonUpgrade systemd-develUpgrade libgudev1Upgrade systemd-libsUpgrade systemdUpgrade systemd-sysvUpgrade libgudev1-develUpgrade systemd-udev-compat | Nov 19, 2019 | Jan 14, 2019 |
| Oracle_linux | — | Upgrade libgudev1-develUpgrade systemd-journal-gatewayUpgrade systemd-networkdUpgrade systemd-libsUpgrade systemd-sysvUpgrade systemd-resolvedUpgrade systemdUpgrade systemd-develUpgrade libgudev1Upgrade systemd-python | Jul 21, 2020 | Aug 17, 2017 |
| Redhat_linux | — | Upgrade systemd-journal-gatewayUpgrade systemd-resolvedUpgrade systemd-develUpgrade systemd-libsUpgrade systemd-debuginfoUpgrade systemd-networkdUpgrade libgudev1Upgrade systemd-sysvUpgrade libgudev1-develUpgrade systemd-pythonUpgrade systemd | Aug 7, 2019 | Jan 14, 2019 |
| Ubuntu | — | Upgrade systemd | Feb 6, 2020 | Jan 14, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub