systemd CVE-2019-3844 Local Privilege Escalation Vulnerability

Bugtraq ID:	108096
Class:	Design Error
CVE:	CVE-2019-3844
Remote:	No
Local:	Yes
Published:	Apr 25 2019 12:00AM
Updated:	Apr 25 2019 12:00AM
Credit:	Jann Horn of Google Project Zero.
Vulnerable:	systemd systemd 240 systemd systemd 239 systemd systemd 237 systemd systemd 235 systemd systemd 234 systemd systemd 233 systemd systemd 229 systemd systemd 228 systemd systemd 223 systemd systemd 214 systemd systemd 213 systemd systemd 209 systemd systemd 208 systemd systemd 207
Not Vulnerable:	systemd systemd 242

systemd CVE-2019-3844 Local Privilege Escalation Vulnerability

systemd is prone to a local privilege-escalation vulnerability.

An attackers may exploit this issue to gain elevated privileges.

Versions prior to systemd 242 are vulnerable.

systemd CVE-2019-3844 Local Privilege Escalation Vulnerability

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

systemd CVE-2019-3844 Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

systemd CVE-2019-3844 Local Privilege Escalation Vulnerability

References:

• Bug 1684610 (CVE-2019-3844) - CVE-2019-3844 systemd: services with DynamicUser c (Red Hat Bugzilla)
  
• core: imply NNP and SUID/SGID restriction for DynamicUser=yes service (systemd)
  
• CVE-2019-3844 (Red Hat Bugzilla)
  
• Issue 1771: systemd: DynamicUser can create setuid binaries when assisted by ano (Google)
  
• systemd Package (freedesktop.org)