CVE-2020-1712: Use After Free
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
Other sources
systemd contains a heap use-after-free vulnerability due to the way asynchronous polkit queries are performed. The userdata that needs to be passed to the polkit callback is cached in the AsyncPolkitQuery structure, however when the callback is actually called, the object the userdata is pointing to may already have been released and re-used for other purposes. Local unprivileged attackers may abuse this flaw to crash systemd services or potentially execute code and elevate their privileges.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/systemdto a version that resolves this vulnerability.Fixed in 245 - Upgrade
Upgrade
debian/systemdto a version that resolves this vulnerability.Fixed in 247.3-7+deb11u5Fixed in 247.3-7+deb11u6Fixed in 252.36-1~deb12u1Fixed in 252.38-1~deb12u1Fixed in 257.6-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in v245-rc1 - Compensating control
Mitigate exploit attempts by restricting access to systemd’s dbus endpoints so that only trusted/local privileged processes can send specially crafted dbus messages that trigger the vulnerable asynchronous Polkit query handling.
Event History
Frequently Asked Questions
What is CVE-2020-1712?
CVE-2020-1712 is a heap use-after-free vulnerability found in systemd before version v245-rc1.
How does CVE-2020-1712 impact systemd services?
CVE-2020-1712 allows a local unprivileged attacker to crash systemd services or potentially execute code and elevate their privileges.
Which software versions are affected by CVE-2020-1712?
CVE-2020-1712 affects systemd versions 241-7~deb10u8, 241-7~deb10u10, 247.3-7+deb11u4, 252.17-1~deb12u1, and 254.5-1 on Debian, and versions 244.1-0ubuntu3 on Ubuntu.
How can I fix CVE-2020-1712?
To fix CVE-2020-1712, update the affected systemd package to version 241-7~deb10u10 or install the latest version available for your Linux distribution.
Where can I find more information about CVE-2020-1712?
You can find more information about CVE-2020-1712 in the following references: [Bugzilla Red Hat](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1712), [GitHub Commit 1](https://github.com/systemd/systemd/commit/1068447e6954dc6ce52f099ed174c442cb89ed54), [GitHub Commit 2](https://github.com/systemd/systemd/commit/637486261528e8aa3da9f26a4487dc254f4b7abb).