CVE-2019-3844

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.

• SECURITY UPDATE: Privilege chaining vulnerability
  • debian/patches/CVE-2019-3843.patch: introduce functionality for blocking chmod() for suid/sgid files with new unit setting RestrictSUIDSGID=
  • CVE-2019-3843
• SECURITY UPDATE: Privilege chaining vulnerability
  • debian/patches/CVE-2019-3844.patch: imply NNP and SUID/SGID restriction for DynamicUser=yes service
  • CVE-2019-3844

These are all security issues fixed in the libsystemd0-249.4-2.2 package on the GA media of openSUSE Tumbleweed.

This update for systemd fixes the following issues:

Security issues fixed:

• CVE-2019-3842: Fixed a privilege escalation in pam_systemd which could be exploited by a local user (bsc#1132348).
• CVE-2019-6454: Fixed a denial of service via crafted D-Bus message (bsc#1125352).
• CVE-2019-3843, CVE-2019-3844: Fixed a privilege escalation where services with DynamicUser could gain new privileges or create SUID/SGID binaries (bsc#1133506, bsc#1133509).

Non-security issued fixed:

• logind: fix killing of scopes (bsc#1125604)
• namespace: make MountFlags=shared work again (bsc#1124122)
• rules: load drivers only on 'add' events (bsc#1126056)
• sysctl: Don't pass null directive argument to '%s' (bsc#1121563)
• systemd-coredump: generate a stack trace of all core dumps and log into the journal (jsc#SLE-5933)
• udevd: notify when max number value of children is reached only once per batch of events (bsc#1132400)
• sd-bus: bump message queue size again (bsc#1132721)
• Do not automatically online memory on s390x (bsc#1127557)
• Removed sg.conf (bsc#1036463)

This update for systemd fixes the following issues:

Security issues fixed:

• CVE-2019-3842: Fixed a privilege escalation in pam_systemd which could be exploited by a local user (bsc#1132348).
• CVE-2019-6454: Fixed a denial of service via crafted D-Bus message (bsc#1125352).
• CVE-2019-3843, CVE-2019-3844: Fixed a privilege escalation where services with DynamicUser could gain new privileges or create SUID/SGID binaries (bsc#1133506, bsc#1133509).

Non-security issued fixed:

• logind: fix killing of scopes (bsc#1125604)
• namespace: make MountFlags=shared work again (bsc#1124122)
• rules: load drivers only on 'add' events (bsc#1126056)
• sysctl: Don't pass null directive argument to '%s' (bsc#1121563)
• systemd-coredump: generate a stack trace of all core dumps and log into the journal (jsc#SLE-5933)
• udevd: notify when max number value of children is reached only once per batch of events (bsc#1132400)
• sd-bus: bump message queue size again (bsc#1132721)
• Do not automatically online memory on s390x (bsc#1127557)
• Removed sg.conf (bsc#1036463)

It was discovered that systemd incorrectly handled certain PIDFile files. A local attacker could possibly use this issue to trick systemd into killing privileged processes. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-16888)

It was discovered that systemd incorrectly handled certain udevadm trigger commands. A local attacker could possibly use this issue to cause systemd to consume resources, leading to a denial of service. (CVE-2019-20386)

Jann Horn discovered that systemd incorrectly handled services that use the DynamicUser property. A local attacker could possibly use this issue to access resources owned by a different service in the future. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-3843, CVE-2019-3844)

Tavis Ormandy discovered that systemd incorrectly handled certain Polkit queries. A local attacker could use this issue to cause systemd to crash, resulting in a denial of service, or possibly execute arbitrary code and escalate privileges. (CVE-2020-1712)