CVE-2019-3843

CVE	CVE-2019-3843
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2019-04-26 21:29:00 UTC
Updated	2023-11-07 03:10:00 UTC
Description	It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.

Problem Types: CWE-269

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Canonical	Ubuntu Linux	16.04	All	All	All
Operating System	Canonical	Ubuntu Linux	18.04	All	All	All
Operating System	Canonical	Ubuntu Linux	19.10	All	All	All
Operating System	Canonical	Ubuntu Linux	16.04	All	All	All
Operating System	Canonical	Ubuntu Linux	18.04	All	All	All
Operating System	Canonical	Ubuntu Linux	19.10	All	All	All
Operating System	Fedoraproject	Fedora	30	All	All	All
Operating System	Fedoraproject	Fedora	30	All	All	All
Application	Freedesktop	Systemd	All	All	All	All
Application	Freedesktop	Systemd	All	All	All	All
Hardware	Netapp	Cn1610	-	All	All	All
Hardware	Netapp	Cn1610	-	All	All	All
Operating System	Netapp	Cn1610 Firmware	-	All	All	All
Operating System	Netapp	Cn1610 Firmware	-	All	All	All
Application	Netapp	Hci Management Node	-	All	All	All
Application	Netapp	Hci Management Node	-	All	All	All
Application	Netapp	Snapprotect	-	All	All	All
Application	Netapp	Snapprotect	-	All	All	All
Application	Netapp	Solidfire	-	All	All	All
Application	Netapp	Solidfire	-	All	All	All
Application	Systemd Project	Systemd	All	All	All	All

Reference	Source	Link	Tags
[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8		lists.apache.org
Pony Mail!	MLIST	lists.apache.org
[SECURITY] Fedora 30 Update: systemd-241-8.git9ef65cb.fc30 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
[SECURITY] Fedora 30 Update: systemd-241-8.git9ef65cb.fc30 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org	Third Party Advisory
1684607 – (CVE-2019-3843) CVE-2019-3843 systemd: services with DynamicUser can create SUID/SGID binaries	CONFIRM	bugzilla.redhat.com	Issue Tracking, Patch, Third Party Advisory
USN-4269-1: systemd vulnerabilities \| Ubuntu security notices	UBUNTU	usn.ubuntu.com	Third Party Advisory
Pony Mail!	MLIST	lists.apache.org
[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8		lists.apache.org
systemd CVE-2019-3843 Local Privilege Escalation Vulnerability	BID	www.securityfocus.com	Third Party Advisory, VDB Entry
May 2019 Systemd Vulnerabilities in NetApp Products \| NetApp Product Security	CONFIRM	security.netapp.com	Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

900080 CBL-Mariner Linux Security Update for systemd 239
903109 Common Base Linux Mariner (CBL-Mariner) Security Update for systemd (1797)