CVE-2019-6454

moderate-risk
Published 2019-03-21

An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).

Do I need to act?

-
0.11% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (20)

Active Iq Performance Analytics Services
Enterprise Linux Compute Node Eus

Affected Vendors

Debian Redhat Mcafee Canonical Fedoraproject Netapp Opensuse Systemd Project

References (36)

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00070.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.html
Mailing List http://www.openwall.com/lists/oss-security/2019/02/18/3
Mailing List http://www.openwall.com/lists/oss-security/2019/02/19/1
Exploit http://www.openwall.com/lists/oss-security/2021/07/20/2
Third Party Advisory http://www.securityfocus.com/bid/107081
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:0368
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:0990
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1322
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1502
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2805
Patch https://github.com/systemd/systemd/commits/master/src/libsystemd/sd-bus/bus-obje...
Patch https://kc.mcafee.com/corporate/index?page=content&id=SB10278
Mailing List https://lists.debian.org/debian-lts-announce/2019/02/msg00031.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Third Party Advisory https://security.netapp.com/advisory/ntap-20190327-0004/
Third Party Advisory https://usn.ubuntu.com/3891-1/
Third Party Advisory https://www.debian.org/security/2019/dsa-4393
Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00070.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.html
and 16 more references
44
/ 100
moderate-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 26/34 · High