CVE-2022-4415: Infoleak
A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suiddumpable kernel setting.
Other sources
systemd-coredump sets the sysctl fs.suiddumpable by default to 2 via a sysctl.d drop-in configuration file. For the kernel's builtin coredump handling this setting means that core dumps for setuid (or otherwise privileged) processes will be written to disk but will only be accessible to the root user to avoid sensitive data leaking to unprivileged user accounts. See also man 5 proc for the full documentation of this sysctl.
https://github.com/systemd/systemd/commit/b7641425659243c09473cd8fb3aef2c0d4a3eb9c
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/systemdto a version that resolves this vulnerability.Fixed in 252.39-1~deb12u2Fixed in 252.38-1~deb12u1Fixed in 257.13-1~deb13u1Fixed in 262-1Fixed in 262.1-1 - Upgrade
Upgrade
debian/systemdto a version that resolves this vulnerability.Fixed in 252.4-1 - Configuration
Configure the fs.suid_dumpable sysctl to 2 so core dumps for setuid or otherwise privileged processes are written to disk but accessible only to root.
systemd-coredump fs.suid_dumpable = 2
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-4415.
What is the title of this vulnerability?
The title of this vulnerability is 'A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.'
What is the severity level of CVE-2022-4415?
The severity level of CVE-2022-4415 is medium with a severity value of 5.5.
How does this vulnerability affect systemd?
This vulnerability affects systemd versions 246 to 253.
How can I fix CVE-2022-4415?
To fix CVE-2022-4415, it is recommended to update systemd to a version beyond 253.