UBUNTU-CVE-2019-3844

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2019-3844
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-3844.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2019-3844
Related
Published
2019-04-26T21:29:00Z
Modified
2019-04-26T21:29:00Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • 7.8 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.

References

Affected packages

Ubuntu:18.04:LTS / systemd

Package

Name
systemd
Purl
pkg:deb/ubuntu/systemd?arch=src?distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
237-3ubuntu10.38

Affected versions

Other

234-2ubuntu12
235-2ubuntu3
235-3ubuntu2
235-3ubuntu3
237-3ubuntu3
237-3ubuntu4
237-3ubuntu6
237-3ubuntu7
237-3ubuntu8
237-3ubuntu10

237-3ubuntu10.*

237-3ubuntu10.2
237-3ubuntu10.3
237-3ubuntu10.4
237-3ubuntu10.6
237-3ubuntu10.9
237-3ubuntu10.11
237-3ubuntu10.12
237-3ubuntu10.13
237-3ubuntu10.15
237-3ubuntu10.17
237-3ubuntu10.19
237-3ubuntu10.20
237-3ubuntu10.21
237-3ubuntu10.22
237-3ubuntu10.23
237-3ubuntu10.24
237-3ubuntu10.25
237-3ubuntu10.26
237-3ubuntu10.28
237-3ubuntu10.29
237-3ubuntu10.31
237-3ubuntu10.33

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "libnss-myhostname"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "libnss-myhostname-dbgsym"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "libnss-mymachines"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "libnss-mymachines-dbgsym"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "libnss-resolve"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "libnss-resolve-dbgsym"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "libnss-systemd"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "libnss-systemd-dbgsym"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "libpam-systemd"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "libpam-systemd-dbgsym"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "libsystemd-dev"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "libsystemd0"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "libsystemd0-dbgsym"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "libudev-dev"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "libudev1"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "libudev1-dbgsym"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "libudev1-udeb"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "systemd"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "systemd-container"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "systemd-container-dbgsym"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "systemd-coredump"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "systemd-coredump-dbgsym"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "systemd-dbgsym"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "systemd-journal-remote"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "systemd-journal-remote-dbgsym"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "systemd-sysv"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "systemd-tests"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "systemd-tests-dbgsym"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "udev"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "udev-dbgsym"
        },
        {
            "binary_version": "237-3ubuntu10.38",
            "binary_name": "udev-udeb"
        }
    ]
}