CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 3CVE-2023-26604 – systemd: privilege escalation via the less pager
https://notcve.org/view.php?id=CVE-2023-26604
03 Mar 2023 — systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output. A vulnerability was found i... • https://packetstorm.news/files/id/174130 •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 1CVE-2022-3821 – systemd: buffer overrun in format_timespan() function
https://notcve.org/view.php?id=CVE-2022-3821
08 Nov 2022 — An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service. Se descubrió un problema de error de uno en uno en Systemd en la función format_timespan() de time-util.c. Un atacante podría proporcionar valores específicos de tiempo y precisión que provoquen una saturación del búfer en format_timespan(), lo que provocará una Deneg... • https://bugzilla.redhat.com/show_bug.cgi?id=2139327 • CWE-193: Off-by-one Error •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 3CVE-2021-33910 – systemd: uncontrolled allocation on the stack in function unit_name_path_escape leads to crash
https://notcve.org/view.php?id=CVE-2021-33910
20 Jul 2021 — basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash. basic/unit-name.c en systemd anterior a las versiones 246.15, 247.8, 248.5 y 249.1 tiene una asignación de memoria con un valor de tamaño excesivo (que involucra a strdupa y alloca para un nombre de ruta controlado por un atacante local) que resulta en una caída del si... • https://packetstorm.news/files/id/163621 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.7EPSS: 0%CPEs: 4EXPL: 0CVE-2020-13776 – systemd: Mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits
https://notcve.org/view.php?id=CVE-2020-13776
03 Jun 2020 — systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082. systemd versiones hasta v245 maneja inapropiadamente los nombres de usuario numéricos, tales como los compuestos por dígitos decimales o 0x seguidos de dígitos hexadecimales, como es demostrado por el uso de privilegio... • https://github.com/systemd/systemd/issues/15985 • CWE-269: Improper Privilege Management CWE-440: Expected Behavior Violation •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2020-1712 – systemd: use-after-free when asynchronous polkit queries are performed
https://notcve.org/view.php?id=CVE-2020-1712
05 Feb 2020 — A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages. Se detectó una vulnerabilidad uso de la memoria previamente liberada de la pila en systemd versiones anteriores a v245-rc1, donde se llevaron a cabo consultas de Polkit asinc... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1712 • CWE-416: Use After Free •
CVSS: 2.4EPSS: 0%CPEs: 9EXPL: 0CVE-2019-20386 – systemd: memory leak in button_open() in login/logind-button.c when udev events are received
https://notcve.org/view.php?id=CVE-2019-20386
21 Jan 2020 — An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur. Se detectó un problema en la función button_open en el archivo login/logind-button.c en systemd versiones anteriores a 243. Cuando se ejecuta el comando de activación udevadm, puede presentarse una pérdida de memoria. A memory leak was discovered in the systemd-login when a power-switch event is received. • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00014.html • CWE-400: Uncontrolled Resource Consumption CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 1CVE-2019-3843 – systemd - DynamicUser can Create setuid Binaries when Assisted by Another Process
https://notcve.org/view.php?id=CVE-2019-3843
26 Apr 2019 — It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled. Se descubrió que un servicio systemd que utiliza la propiedad DynamicUser puede crear un binario SUID/SGID que podría ejecutarse como servicio transito... • https://www.exploit-db.com/exploits/46760 • CWE-266: Incorrect Privilege Assignment CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 2CVE-2019-3844 – systemd - DynamicUser can Create setuid Binaries when Assisted by Another Process
https://notcve.org/view.php?id=CVE-2019-3844
25 Apr 2019 — It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled. Se ha descubierto una vulnerabilidad en el servicio systemd que utilice la propiedad DynamicUser pudiendo obtener nuevos pr... • https://packetstorm.news/files/id/152635 • CWE-268: Privilege Chaining •
CVSS: 7.0EPSS: 0%CPEs: 7EXPL: 3CVE-2019-3842 – systemd - Lack of Seat Verification in PAM Module Permits Spoofing Active Session to polkit
https://notcve.org/view.php?id=CVE-2019-3842
09 Apr 2019 — In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any". En systemd anterior de la versión v242-rc4, fue encontrado que pam_systemd no sanea apropiadamente el entorno anterior usando la variable XDG_... • https://packetstorm.news/files/id/152610 • CWE-285: Improper Authorization CWE-863: Incorrect Authorization •
CVSS: 4.7EPSS: 0%CPEs: 7EXPL: 0CVE-2018-16888 – systemd: kills privileged process if unprivileged PIDFile was tampered
https://notcve.org/view.php?id=CVE-2018-16888
14 Jan 2019 — It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable. Se ha descubierto que systemd no comprueba correctamente el contenido de archivos PIDFile antes de ... • https://access.redhat.com/errata/RHSA-2019:2091 • CWE-250: Execution with Unnecessary Privileges CWE-269: Improper Privilege Management •