systemd vulnerabilities

In systemd (system and service manager running as PID 1), an unprivileged IPC API call with spurious data triggers an assert and freezes execution. On version v249 and older the effect is stack overwriting with attacker-controlled content, while from v250 the safety check causes an assert instead. The IPC call was added in v239, so older versions are not affected.

In systemd versions 223 through 235, a remote DNS server can respond with a custom crafted NSEC resource record to trigger an infinite loop in the dns_packet_read_type_window() function of the 'systemd-resolved' service, causing a DoS of the affected service.

In systemd versions up to 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, leading to arbitrary data being written beyond its end.

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root.

A vulnerability in systemd causes systemd-coredump to ignore the kernel's fs.suid_dumpable setting, potentially leading to a local information leak.

In udev in systemd before version 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

In systemd versions 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file in nspawn.

It was discovered that a systemd service using the DynamicUser property can gain new privileges through the execution of SUID binaries, allowing creation of binaries owned by the service's transient group with the setgid bit set. A local attacker may exploit this flaw to access resources that will be.

A vulnerability was found in systemd where a service using the DynamicUser property can create a SUID/SGID binary that remains executable with the transient service UID/GID even after the service terminates. A local attacker could exploit this to access resources owned by a potentially different UID/GID.

In systemd before versions 246.15, 247.8, 248.5, and 249.1, basic/unit-name.c has excessive memory allocation (via strdupa and alloca) for a pathname controlled by a local attacker, leading to an operating system crash.

There is a stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit, resulting in the service running with root privileges instead of the intended user privileges.

systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user.

When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. Versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file. Versions older than v258 are not affected. Unrelated to the systemd service manager (pid 1 or user session managers). systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container). Terminal-only or remote sessions (e.g.: ssh) are not affected.

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.

A vulnerability in systemd-coredump allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump. This enables reading sensitive data, such as /etc/shadow content, loaded by the original process.

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology is to crash a binary calling the same function recursively, and put it in a deeply nested directory to make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16 is set for the systemd/units/systemd-coredump.socket file.

An off-by-one error was discovered in systemd in the format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy, leading to a buffer overrun in format_timespan() and resulting in a denial of service.

A flaw was found in systemd where uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.

An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DHCP ACK packets to reconfigure the server.

systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.