It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 4.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade systemd-journal-remote-debuginfoUpgrade systemd-udevUpgrade systemd-tests-debuginfoUpgrade systemd-journal-remoteUpgrade systemdUpgrade systemd-testsUpgrade systemd-container-debuginfoUpgrade systemd-libs-debuginfoUpgrade systemd-pamUpgrade systemd-libsUpgrade systemd-develUpgrade systemd-pam-debuginfoUpgrade systemd-containerUpgrade systemd-debugsourceUpgrade systemd-debuginfoUpgrade systemd-udev-debuginfo | Apr 29, 2020 | Apr 26, 2019 |
| Debian | — | Upgrade systemd | Jul 30, 2024 | Apr 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade systemd-containerUpgrade systemd-libsUpgrade systemd-develUpgrade systemd-pamUpgrade systemd-udevUpgrade systemdUpgrade systemd-journal-remoteUpgrade systemd-udev-compat | Jun 27, 2019 | Apr 26, 2019 |
| Oracle_linux | — | Upgrade systemd-testsUpgrade systemd-libsUpgrade systemd-containerUpgrade systemd-journal-remoteUpgrade systemd-pamUpgrade systemdUpgrade systemd-udevUpgrade systemd-devel | Oct 5, 2022 | Apr 25, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Apr 26, 2019 |
| Redhat_linux | — | Upgrade systemdUpgrade systemd-develUpgrade systemd-containerUpgrade systemd-tests-debuginfoUpgrade systemd-debugsourceUpgrade systemd-libs-debuginfoUpgrade systemd-libsUpgrade systemd-udev-debuginfoUpgrade systemd-journal-remote-debuginfoUpgrade systemd-pamUpgrade systemd-testsUpgrade systemd-udevUpgrade systemd-debuginfoUpgrade systemd-pam-debuginfoUpgrade systemd-journal-remoteUpgrade systemd-container-debuginfo | Apr 29, 2020 | Apr 26, 2019 |
| Suse | — | Upgrade systemd-journal-remoteUpgrade systemdUpgrade udevUpgrade systemd-develUpgrade systemd-32bitUpgrade systemd-langUpgrade systemd-docUpgrade libsystemd0-32bitUpgrade libudev1Upgrade systemd-coredumpUpgrade libsystemd0Upgrade systemd-containerUpgrade systemd-sysvinitUpgrade libudev1-32bitUpgrade systemd-bash-completionUpgrade libudev-devel | Feb 4, 2022 | Apr 26, 2019 |
| Ubuntu | — | Upgrade systemd | Feb 6, 2020 | Apr 26, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub