Race condition in systemd - CVE-2018-1049

Vulnerability identifier: #VU10365

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1049

CWE-ID: CWE-362

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows an adjacent attacker to cause DoS condition no the target system.

The weakness exists in GNU systemd due to an error when handling malicious input. An adjacent attacker can submit a specially crafted automount request, trigger race condition and cause the service to crash.

systemd
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
Ubuntu

Install update from vendor's website.

• https://github.com/systemd/systemd/pull/5916

• Denial of service in systemd
• Ubuntu update for systemd
• Red Hat update for systemd