REDHAT-BUG-2450505: Medium severity systemd systemd vulnerability
systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
systemdto a version that resolves this vulnerability.Patch 260-rc1 - Upgrade
Upgrade
systemdto a version that resolves this vulnerability.Patch 259.2 - Upgrade
Upgrade
systemdto a version that resolves this vulnerability.Patch 258.5 - Upgrade
Upgrade
systemdto a version that resolves this vulnerability.Patch 257.11
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2450505?
REDHAT-BUG-2450505 is considered a critical vulnerability due to the potential for execution freeze and stack overwriting.
How do I fix REDHAT-BUG-2450505?
To fix REDHAT-BUG-2450505, upgrade systemd to a version newer than 257.11 or 258.5 depending on your current version.
What versions of systemd are affected by REDHAT-BUG-2450505?
REDHAT-BUG-2450505 affects systemd versions from 239 up to 257.11, along with specific versions up to 260-rc1.
Can unprivileged users exploit REDHAT-BUG-2450505?
Yes, unprivileged users can exploit REDHAT-BUG-2450505 through malicious IPC API calls that provide spurious data.
What impact does REDHAT-BUG-2450505 have on system performance?
The impact of REDHAT-BUG-2450505 includes execution freezing or stack corruption, which could lead to system instability and denial of service.