CVE-2019-3844

NameCVE-2019-3844
DescriptionIt was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs928102

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
systemd (PTS)jessie, jessie (lts)215-17+deb8u15fixed
stretch (security)232-25+deb9u14vulnerable
stretch (lts), stretch232-25+deb9u17vulnerable
buster, buster (lts)241-7~deb10u11vulnerable
buster (security)241-7~deb10u10vulnerable
bullseye247.3-7+deb11u5fixed
bullseye (security)247.3-7+deb11u6fixed
bookworm252.31-1~deb12u1fixed
sid, trixie257~rc2-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
systemdsourceexperimental242-1
systemdsourcewheezy(not affected)
systemdsourcejessie(not affected)
systemdsource(unstable)242-4928102

Notes

[buster] - systemd <ignored> (Minor issue; exploit vector needs control both of the service and a helper outside)
[stretch] - systemd <ignored> (Minor issue; exploit vector needs control both of the service and a helper outside)
[jessie] - systemd <not-affected> (Vulnerable code introduced later)
https://bugzilla.redhat.com/show_bug.cgi?id=1684610
https://github.com/systemd/systemd/commit/bf65b7e0c9fc215897b676ab9a7c9d1c688143ba
https://bugs.chromium.org/p/project-zero/issues/detail?id=1771
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1814596
[wheezy] - systemd <not-affected> (Vulnerable code introduced later)

Search for package or bug name: Reporting problems