CVE-2019-3843

Published: 26 April 2019

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.

Priority

Cvss 3 Severity Score

7.8

Score breakdown

Status

Package	Release	Status
systemd Launchpad, Ubuntu, Debian	bionic	Released (237-3ubuntu10.38)
	cosmic	Ignored (end of life)
	disco	Ignored (end of life)
	eoan	Not vulnerable (242-7ubuntu3.2)
	trusty	Not vulnerable (code not present)
	upstream	Needs triage
	xenial	Not vulnerable (code not present)
	Patches: upstream: https://github.com/systemd/systemd/commit/3c27973b13724ede05a06a5d346a569794cda433 upstream: https://github.com/systemd/systemd/commit/f69567cbe26d09eac9d387c0be0fc32c65a83ada upstream: https://github.com/systemd/systemd/commit/9d880b70ba5c6ca83c82952f4c90e86e56c7b70c upstream: https://github.com/systemd/systemd/commit/7445db6eb70e8d5989f481d0c5a08ace7047ae5b upstream: https://github.com/systemd/systemd/commit/62aa29247c3d74bcec0607c347f2be23cd90675d upstream: https://github.com/systemd/systemd/commit/bf65b7e0c9fc215897b676ab9a7c9d1c688143ba upstream: https://github.com/systemd/systemd-stable/commit/9e6e543c173460f394ea13c9b2aa572aef1f6833 upstream: https://github.com/systemd/systemd-stable/commit/3c27973b13724ede05a06a5d346a569794cda433 upstream: https://github.com/systemd/systemd-stable/commit/167fc10cb352b04d442c9010dab4f8dc24219749 upstream: https://github.com/systemd/systemd-stable/commit/f69567cbe26d09eac9d387c0be0fc32c65a83ada upstream: https://github.com/systemd/systemd-stable/commit/9d880b70ba5c6ca83c82952f4c90e86e56c7b70c upstream: https://github.com/systemd/systemd-stable/commit/7445db6eb70e8d5989f481d0c5a08ace7047ae5b upstream: https://github.com/systemd/systemd-stable/commit/62aa29247c3d74bcec0607c347f2be23cd90675d upstream: https://github.com/systemd/systemd-stable/commit/bf65b7e0c9fc215897b676ab9a7c9d1c688143ba

Severity score breakdown

Parameter	Value
Base score	7.8
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Bugs

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›