Use-after-free in systemd - CVE-2020-1712

Vulnerability identifier: #VU25332

CSH Severity: Low

CVSS v4: 9.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]

CVE-ID: CVE-2020-1712

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error when processing dbus messages during asynchronous Polkit queries in bus-polkit.c in systemd. A local unprivileged user can send a specially crafted dbus message, trigger a use-after-free error and crash services or execute arbitrary code on the system with elevated privileges.

systemd
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
systemd-container
systemd-debuginfo
systemd-debugsource
systemd-devel
systemd-help
systemd-journal-remote
systemd-libs
systemd-udev
systemd-udev-compat
Arch Linux
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Opensuse
openEuler
Fedora

Install update from vendor's website.

systemd - update to 245 rc1
systemd - update to 241-14.git18dd3fb.fc30
systemd - update to 243-22
systemd-container - update to 243-22
systemd-debuginfo - update to 243-22
systemd-debugsource - update to 243-22
systemd-devel - update to 243-22
systemd-help - update to 243-22
systemd-journal-remote - update to 243-22
systemd-libs - update to 243-22
systemd-udev - update to 243-22
systemd-udev-compat - update to 243-22

• https://github.com/systemd/systemd/commit/ea0d0ede03c6f18dbc5036c5e9cccf97e415ccc2
• https://github.com/systemd/systemd-stable/commit/e2d4cb9843c50eff76e9104fec6b448c0d7c8814

• Privilege escalation in systemd
• OpenSUSE Linux update for systemd
• Arch Linux update for systemd
• Red Hat update for systemd
• Red Hat update for systemd
• Gentoo update for systemd
• openEuler 20.03 LTS update for systemd-243-22
• Fedora 30 update for systemd