CVE-2019-6454: Medium severity systemd vulnerability
An issue was discovered in sd-bus in systemd 239. busprocessobject() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).
Other sources
It was found that busprocessobject() in bus-objects.c allocates a buffer on the stack large enough to temporarily store the object path specified in the incoming message. A malicious unprivileged local user to send a message which results in the stack pointer moving outside of the bounds of the currently mapped stack region, jumping over the stack guard pages. A specifically crafted DBUS nessage could crash PID 1 and result in a subsequent kernel panic.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-6454?
CVE-2019-6454 has been classified as a high severity vulnerability.
How do I fix CVE-2019-6454?
To fix CVE-2019-6454, upgrade the systemd package to version 247.3-7+deb11u5 or higher.
Which systems are affected by CVE-2019-6454?
CVE-2019-6454 affects systemd version 239 and its various distributions, including Debian, Ubuntu, and Red Hat.
What impact does CVE-2019-6454 have?
An unprivileged local user can exploit CVE-2019-6454 to execute arbitrary code via crafted D-Bus messages.
Is CVE-2019-6454 exploitable remotely?
No, CVE-2019-6454 requires local access to the system to exploit.