CVE-2019-15718

moderate-risk
Published 2019-09-04

In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.

Do I need to act?

-
0.10% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.4/10 Medium
LOCAL / LOW complexity

Affected Products (20)

Enterprise Linux For Ibm Z Systems 8 S390X

Affected Vendors

Redhat Fedoraproject Systemd Project

References (14)

Exploit http://www.openwall.com/lists/oss-security/2019/09/03/1
Issue Tracking https://access.redhat.com/errata/RHSA-2019:3592
Issue Tracking https://access.redhat.com/errata/RHSA-2019:3941
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1746057
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Exploit http://www.openwall.com/lists/oss-security/2019/09/03/1
Issue Tracking https://access.redhat.com/errata/RHSA-2019:3592
Issue Tracking https://access.redhat.com/errata/RHSA-2019:3941
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1746057
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
37
/ 100
moderate-risk
Severity 15/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 22/34 · High