Vulnerability Description
It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Systemd Project | Systemd | < 242 |
| Canonical | Ubuntu Linux | 16.04 |
| Netapp | Hci Management Node | - |
| Netapp | Snapprotect | - |
| Netapp | Solidfire | - |
| Netapp | Cn1610 Firmware | - |
| Netapp | Cn1610 | - |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/108096Third Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3844Issue TrackingPatchThird Party Advisory
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e3
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8
- https://security.netapp.com/advisory/ntap-20190619-0002/Third Party Advisory
- https://usn.ubuntu.com/4269-1/Third Party Advisory
- http://www.securityfocus.com/bid/108096Third Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3844Issue TrackingPatchThird Party Advisory
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e3
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8
- https://security.netapp.com/advisory/ntap-20190619-0002/Third Party Advisory
- https://usn.ubuntu.com/4269-1/Third Party Advisory
FAQ
What is CVE-2019-3844?
CVE-2019-3844 is a vulnerability with a CVSS score of 7.8 (HIGH). It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transie...
How severe is CVE-2019-3844?
CVE-2019-3844 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-3844?
Check the references section above for vendor advisories and patch information. Affected products include: Systemd Project Systemd, Canonical Ubuntu Linux, Netapp Hci Management Node, Netapp Snapprotect, Netapp Solidfire.