A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
Se detectó una vulnerabilidad uso de la memoria previamente liberada de la pila en systemd versiones anteriores a v245-rc1, donde se llevaron a cabo consultas de Polkit asincrónicas mientras se manejan mensajes dbus. Un atacante no privilegiado local puede abusar de este fallo para bloquear los servicios de systemd o potencialmente ejecutar código y elevar sus privilegios, mediante el envío de mensajes dbus especialmente diseñados.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:L/AC:L/Au:N/C:P/I:P/A:P
| Access Vector | LOCAL |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-416
|
| [email protected] | Primary |
en
CWE-416
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| systemd_project | systemd | * | <built-in method update of dict object at 0x7fd36a7ee2c0> | Application |
| redhat | ceph_storage | 4.0 | <built-in method update of dict object at 0x7fd319c74780> | Application |
| redhat | discovery | - | <built-in method update of dict object at 0x7fd3485cae80> | Application |
| redhat | migration_toolkit | 1.0 | <built-in method update of dict object at 0x7fd34948d800> | Application |
| redhat | openshift_container_platform | 4.0 | <built-in method update of dict object at 0x7fd36a7edf00> | Application |
| redhat | enterprise_linux | 8.0 | <built-in method update of dict object at 0x7fd3104ff780> | Operating System |
| debian | debian_linux | 9.0 | <built-in method update of dict object at 0x7fd3694f3740> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:redhat:discovery:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:redhat:migration_toolkit:1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |