Bugzilla – Bug 1133509
VUL-0: CVE-2019-3844: systemd: services with DynamicUser can get new privileges and create SGID binaries
Last modified: 2021-07-19 14:00:18 UTC
rh#1684610 It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled. References: https://bugzilla.redhat.com/show_bug.cgi?id=1684610 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-3844
I submitted new MR#192322 which should fix both this bug and bsc#1133506. Re-assigning to the secteam.
SUSE-SU-2019:1364-1: An update that solves four vulnerabilities and has 9 fixes is now available. Category: security (moderate) Bug References: 1036463,1121563,1124122,1125352,1125604,1126056,1127557,1130230,1132348,1132400,1132721,1133506,1133509 CVE References: CVE-2019-3842,CVE-2019-3843,CVE-2019-3844,CVE-2019-6454 Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): systemd-234-24.30.1, systemd-mini-234-24.30.1 SUSE Linux Enterprise Module for Basesystem 15 (src): systemd-234-24.30.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:1364-2: An update that solves four vulnerabilities and has 9 fixes is now available. Category: security (moderate) Bug References: 1036463,1121563,1124122,1125352,1125604,1126056,1127557,1130230,1132348,1132400,1132721,1133506,1133509 CVE References: CVE-2019-3842,CVE-2019-3843,CVE-2019-3844,CVE-2019-6454 Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): systemd-234-24.30.1, systemd-mini-234-24.30.1 SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): systemd-234-24.30.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
done (leap 15 is in queue)
The DynamicUser feature is not available in systemd on SLES 12, so SLE12 is not affected.