CVE-2019-3844

NameCVE-2019-3844
DescriptionIt was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs928102

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
systemd (PTS)stretch232-25+deb9u12vulnerable
stretch (security)232-25+deb9u13vulnerable
buster241-7~deb10u7vulnerable
buster (security)241-7~deb10u8vulnerable
bullseye247.3-6fixed
bookworm247.9-1fixed
sid247.9-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
systemdsourceexperimental242-1
systemdsourcejessie(not affected)
systemdsource(unstable)242-4928102

Notes

[buster] - systemd <ignored> (Minor issue; exploit vector needs control both of the service and a helper outside)
[stretch] - systemd <ignored> (Minor issue; exploit vector needs control both of the service and a helper outside)
[jessie] - systemd <not-affected> (Vulnerable code introduced later)
https://bugzilla.redhat.com/show_bug.cgi?id=1684610
https://github.com/systemd/systemd/commit/bf65b7e0c9fc215897b676ab9a7c9d1c688143ba
https://bugs.chromium.org/p/project-zero/issues/detail?id=1771
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1814596

Search for package or bug name: Reporting problems