SUSE-RU-2024:0214-1: Recommended update for systemd
This update for systemd fixes the following issues: resolved: actually check authenticated flag of SOA transaction core/mount: Make device deps from /proc/self/mountinfo and .mount unit file exclusive core: Add trace logging to mountadddevicedependencies() core/mount: Remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) core/mount: Set Mount.fromprocselfmountinfo flag before adding default dependencies core: wrap some long comment utmp-wtmp: Handle EINTR gracefully when waiting to write to tty utmp-wtmp: Fix error in case isatty() fails homed: Handle EINTR gracefully when waiting for device node resolved: Handle EINTR returned from fdwaitforevent() better sd-netlink: Handle EINTR from poll() gracefully, as success varlink: Handle EINTR gracefully when waiting for EIO via ppoll() stdio-bridge: Don't be bothered with EINTR sd-bus: Handle EINTR return from buspoll() (bsc#1215241) core: Replace slice dependencies as they get added (bsc#1214668)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/systemd-debuginfoto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-network-debuginfoto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-networkto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-debugsourceto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/libsystemd0-minito a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/udev-mini-debuginfoto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-sysvinitto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-container-debuginfoto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-experimentalto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-coredump-debuginfoto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-journal-remoteto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-journal-remote-debuginfoto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-minito a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/nss-myhostnameto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-containerto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/udev-debuginfoto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/libsystemd0-debuginfoto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/nss-myhostname-debuginfoto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-coredumpto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-portableto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-mini-sysvinitto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/nss-systemd-debuginfoto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/udevto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/udev-minito a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-mini-debuginfoto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-mini-container-debuginfoto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/libudev-mini1to a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/libsystemd0to a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-develto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-testsuite-debuginfoto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-docto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/libudev1to a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-testsuiteto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-mini-docto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-mini-develto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/libudev1-debuginfoto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-mini-containerto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/nss-systemdto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/libsystemd0-mini-debuginfoto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-experimental-debuginfoto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-portable-debuginfoto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/libudev-mini1-debuginfoto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-mini-debugsourceto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemdto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/libsystemd0to a version that resolves this vulnerability.Fixed in 32bit-debuginfo-249.17-150400.8.40.1 - Upgrade
Upgrade
suse/nss-myhostnameto a version that resolves this vulnerability.Fixed in 32bit-249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemdto a version that resolves this vulnerability.Fixed in 32bit-249.17-150400.8.40.1 - Upgrade
Upgrade
suse/nss-myhostnameto a version that resolves this vulnerability.Fixed in 32bit-debuginfo-249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemdto a version that resolves this vulnerability.Fixed in 32bit-debuginfo-249.17-150400.8.40.1 - Upgrade
Upgrade
suse/libudev1to a version that resolves this vulnerability.Fixed in 32bit-debuginfo-249.17-150400.8.40.1 - Upgrade
Upgrade
suse/libudev1to a version that resolves this vulnerability.Fixed in 32bit-249.17-150400.8.40.1 - Upgrade
Upgrade
suse/libsystemd0to a version that resolves this vulnerability.Fixed in 32bit-249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemd-langto a version that resolves this vulnerability.Fixed in 249.17-150400.8.40.1 - Upgrade
Upgrade
suse/libudev1to a version that resolves this vulnerability.Fixed in 64bit-debuginfo-249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemdto a version that resolves this vulnerability.Fixed in 64bit-249.17-150400.8.40.1 - Upgrade
Upgrade
suse/systemdto a version that resolves this vulnerability.Fixed in 64bit-debuginfo-249.17-150400.8.40.1 - Upgrade
Upgrade
suse/libudev1to a version that resolves this vulnerability.Fixed in 64bit-249.17-150400.8.40.1 - Upgrade
Upgrade
suse/libsystemd0to a version that resolves this vulnerability.Fixed in 64bit-debuginfo-249.17-150400.8.40.1 - Upgrade
Upgrade
suse/libsystemd0to a version that resolves this vulnerability.Fixed in 64bit-249.17-150400.8.40.1 - Upgrade
Upgrade
suse/nss-myhostnameto a version that resolves this vulnerability.Fixed in 64bit-debuginfo-249.17-150400.8.40.1 - Upgrade
Upgrade
suse/nss-myhostnameto a version that resolves this vulnerability.Fixed in 64bit-249.17-150400.8.40.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-2024-214=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.3-2024-214=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.4-2024-214=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.5-2024-214=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Basesystem-15-SP5-2024-214=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-214=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-Leap-Micro-5.3-2024-214=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-Leap-Micro-5.4-2024-214=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.5-2024-214=1
Event History
Frequently Asked Questions
Which systems should be prioritized for this update?
Prioritize SUSE systems with installed systemd components, especially those using mount units, systemd-resolved, systemd-homed, udev, netlink, D-Bus, or utmp/wtmp handling. The affected package set includes systemd, libsystemd0, libudev1, systemd-sysvinit, and systemd-container.
What operational symptoms may indicate exposure to the fixed issues?
Relevant symptoms include interrupted or unreliable handling of operations affected by EINTR, such as waiting for terminal writes, device nodes, poll events, netlink activity, D-Bus polling, varlink operations, or systemd-resolved processing. Mount dependency behavior may also be incorrect when mount information from /proc/self/mountinfo changes.
Is a configuration change or attacker-controlled input required for the mount-related fixes to matter?
The available information does not identify an attacker prerequisite or a specific non-default configuration. It does indicate that the mount-related changes involve dependencies derived from /proc/self/mountinfo and .mount unit files, including replacement of slice dependencies as they are added.