SB2018020503 - Denial of service in systemd
Published: February 5, 2018
Security Bulletin ID
SB2018020503
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Race condition (CVE-ID: CVE-2018-1049)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows an adjacent attacker to cause DoS condition no the target system.
The weakness exists in GNU systemd due to an error when handling malicious input. An adjacent attacker can submit a specially crafted automount request, trigger race condition and cause the service to crash.
Remediation
Install update from vendor's website.