Permissions, Privileges, and Access Controls in systemd - CVE-2019-3844
Published: January 29, 2020
Vulnerability identifier: #VU24717
CSH Severity: Low
CVSS v4: 9.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2019-3844
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to the systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local user may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.
Affected software
systemd
systemd (Red Hat package)
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
systemd (Red Hat package)
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
How to mitigate CVE-2019-3844
Install updates from vendor's website.
systemd - update to 242
systemd (Red Hat package) - update to 239-29.el8
systemd (Red Hat package) - update to 239-29.el8