Uncontrolled recursion in systemd - CVE-2021-3997

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU59358

Uncontrolled recursion in systemd - CVE-2021-3997

Published: January 10, 2022 / Updated: January 11, 2022


Vulnerability identifier: #VU59358
CSH Severity: Low
CVSS v4: 8.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H]
CVE-ID: CVE-2021-3997
CWE-ID: CWE-674
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to uncontrolled recursion in systemd-tmpfiles. A local user can create multiple nested directories in the /tmp folder and case systemd to crash during the system boot.


Affected software

systemd
systemd-debugsource
systemd-devel
systemd-container
systemd-udev
systemd-journal-remote
systemd-debuginfo
systemd-udev-compat
systemd-libs
systemd-help
systemd (Ubuntu package)
libsystemd0-debuginfo
systemd-lang
systemd-32bit-debuginfo
systemd-32bit
libudev1-32bit-debuginfo
libudev1-32bit
libsystemd0-32bit
libsystemd0
libudev1
libudev1-debuginfo
systemd-container-debuginfo
systemd-journal-remote-debuginfo
systemd-sysvinit
udev
udev-debuginfo
libsystemd0-32bit-debuginfo
systemd-doc
systemd-coredump-debuginfo
systemd-coredump
libudev-devel
sys-apps/systemd-tmpfiles
sys-apps/systemd
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Amazon Linux AMI
Gentoo Linux
SUSE Manager Server
SUSE Manager Proxy
SUSE MicroOS
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
openEuler
Ubuntu
Fedora
Voice Gateway
DataStax Hyper-Converged Database
webMethods Managed File Transfer

How to mitigate CVE-2021-3997

Install update from vendor's website.

systemd - update to 250.2
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.2.1
Voice Gateway - update to 1.0.8.12
DataStax Hyper-Converged Database - update to 1.2.5
systemd-debugsource - update to 243-49
systemd - update to 243-49
systemd-devel - update to 243-49
systemd-container - update to 243-49
systemd-udev - update to 243-49
systemd-journal-remote - update to 243-49
systemd-debuginfo - update to 243-49
systemd-udev-compat - update to 243-49
systemd-libs - update to 243-49
systemd-help - update to 243-49
systemd (Ubuntu package) - addressed in versions 245.4-4ubuntu3.15, 247.3-3ubuntu3.7, 248.3-1ubuntu8.2
libsystemd0-debuginfo - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
systemd-lang - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
systemd-32bit-debuginfo - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
systemd-32bit - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
libudev1-32bit-debuginfo - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
libudev1-32bit - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
libsystemd0-32bit - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
libsystemd0 - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
libudev1 - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
libudev1-debuginfo - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
systemd - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
systemd-container - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
systemd-container-debuginfo - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
systemd-debuginfo - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
systemd-debugsource - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
systemd-journal-remote - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
systemd-journal-remote-debuginfo - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
systemd-sysvinit - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
udev - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
udev-debuginfo - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
libsystemd0-32bit-debuginfo - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
systemd-doc - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
systemd-devel - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
systemd-coredump-debuginfo - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
systemd-coredump - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
libudev-devel - addressed in versions 246.16-7.33.1, 246.16-150300.7.39.1
systemd - addressed in versions 248.10-1.fc34, 249.9-1.fc35
sys-apps/systemd-tmpfiles - update to 251.3
sys-apps/systemd - update to 251.3
systemd - update to 252.4-1161

External References

Related Security Bulletins