{"id":"CVE-2019-3843","aliases":["CLSA-2025-1763418591","DEBIAN-CVE-2019-3843","EUVD-2019-13463","GHSA-54p3-x8px-4jp3","RHSA-2020:1794","SUSE-SU-2019:1364-1","SUSE-SU-2019:1364-2","UBUNTU-CVE-2019-3843","USN-4269-1","openSUSE-SU-2024:11420-1"],"status":"published","title":"It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID...","description":"It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.","severity":{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.0094,"percentile":0.61178,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-266","CWE-269"],"published":"2019-04-26T20:27:30Z","modified":"2026-10-24T10:30:57Z","exploits":[{"source":"exploitdb","id":"EDB-46760","title":"systemd - DynamicUser can Create setuid Binaries when Assisted by Another Process","type":"dos","platform":"linux","date":"2019-04-26","verified":true,"url":"https://www.exploit-db.com/exploits/46760"}],"fixes":[{"ecosystem":"Debian:12","package":"systemd","fixed_in":["242-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"systemd","fixed_in":["242-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"systemd","fixed_in":["242-4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"systemd","fixed_in":["237-3ubuntu10.38"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnss-myhostname","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnss-mymachines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnss-resolve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnss-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libpam-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libsystemd-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libsystemd0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libudev-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libudev1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"systemd-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"systemd-coredump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"systemd-journal-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"systemd-sysv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"systemd-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"udev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"242-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"242-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"242-4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-container-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-journal-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-journal-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-udev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-udev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"234-24.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"234-24.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"237-3ubuntu10.38"}]}],"versions":["234-2ubuntu12","235-2ubuntu3","235-3ubuntu2","235-3ubuntu3","237-3ubuntu3","237-3ubuntu4","237-3ubuntu6","237-3ubuntu7","237-3ubuntu8","237-3ubuntu10","237-3ubuntu10.2","237-3ubuntu10.3","237-3ubuntu10.4","237-3ubuntu10.6","237-3ubuntu10.9","237-3ubuntu10.11","237-3ubuntu10.12","237-3ubuntu10.13","237-3ubuntu10.15","237-3ubuntu10.17","237-3ubuntu10.19","237-3ubuntu10.20","237-3ubuntu10.21","237-3ubuntu10.22","237-3ubuntu10.23","237-3ubuntu10.24","237-3ubuntu10.25","237-3ubuntu10.26","237-3ubuntu10.28","237-3ubuntu10.29","237-3ubuntu10.31","237-3ubuntu10.33"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"229-4ubuntu21.27"}]}],"versions":["225-1ubuntu9","227-2ubuntu1","227-2ubuntu2","228-1ubuntu2","228-2ubuntu1","228-2ubuntu2","228-3ubuntu1","228-4ubuntu1","228-4ubuntu2","228-5ubuntu1","228-5ubuntu2","228-5ubuntu3","228-6ubuntu1","229-1ubuntu2","229-1ubuntu4","229-2ubuntu1","229-3ubuntu1","229-3ubuntu2","229-4ubuntu1","229-4ubuntu4","229-4ubuntu5","229-4ubuntu6","229-4ubuntu7","229-4ubuntu8","229-4ubuntu10","229-4ubuntu11","229-4ubuntu12","229-4ubuntu13","229-4ubuntu16","229-4ubuntu17","229-4ubuntu19","229-4ubuntu20","229-4ubuntu21","229-4ubuntu21.1","229-4ubuntu21.2","229-4ubuntu21.3","229-4ubuntu21.4","229-4ubuntu21.5","229-4ubuntu21.6","229-4ubuntu21.8","229-4ubuntu21.9","229-4ubuntu21.10","229-4ubuntu21.15","229-4ubuntu21.16","229-4ubuntu21.17","229-4ubuntu21.19","229-4ubuntu21.21","229-4ubuntu21.22","229-4ubuntu21.23"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"237-3ubuntu10.38"}]}],"versions":["234-2ubuntu12","235-2ubuntu3","235-3ubuntu2","235-3ubuntu3","237-3ubuntu3","237-3ubuntu4","237-3ubuntu6","237-3ubuntu7","237-3ubuntu8","237-3ubuntu10","237-3ubuntu10.2","237-3ubuntu10.3","237-3ubuntu10.4","237-3ubuntu10.6","237-3ubuntu10.9","237-3ubuntu10.11","237-3ubuntu10.12","237-3ubuntu10.13","237-3ubuntu10.15","237-3ubuntu10.17","237-3ubuntu10.19","237-3ubuntu10.20","237-3ubuntu10.21","237-3ubuntu10.22","237-3ubuntu10.23","237-3ubuntu10.24","237-3ubuntu10.25","237-3ubuntu10.26","237-3ubuntu10.28","237-3ubuntu10.29","237-3ubuntu10.31","237-3ubuntu10.33"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"249.4-2.2"}]}],"bundled":19}],"products":[{"vendor":"[freedesktop.org]","product":"systemd"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"netapp","product":"cn1610_firmware"},{"vendor":"netapp","product":"hci_management_node"},{"vendor":"netapp","product":"snapprotect"},{"vendor":"netapp","product":"solidfire"},{"vendor":"systemd","product":"systemd"},{"vendor":"systemd_project","product":"systemd"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3843","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5JXQAKSTMABZ46EVCRMW62DHWYHTTFES/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/108116","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190619-0002/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4269-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3843","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5JXQAKSTMABZ46EVCRMW62DHWYHTTFES"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JXQAKSTMABZ46EVCRMW62DHWYHTTFES"},{"url":"https://security.netapp.com/advisory/ntap-20190619-0002"},{"url":"https://usn.ubuntu.com/4269-1"},{"url":"https://github.com/advisories/GHSA-54p3-x8px-4jp3"},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2025-1763418591.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-3843","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1794","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1684607","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1684610","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1689346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1696602","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1717603","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1719577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1724617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734787","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1735787","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1743235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1748258","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1749212","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1752050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1753369","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1762679","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1763155","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1763161","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1763619","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1770189","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1776408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1777110","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1778384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1808940","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1794.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3843","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3843","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3844","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3844","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3844","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191364-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1036463","tags":["report"]},{"url":"https://bugzilla.suse.com/1121563","tags":["report"]},{"url":"https://bugzilla.suse.com/1124122","tags":["report"]},{"url":"https://bugzilla.suse.com/1125352","tags":["report"]},{"url":"https://bugzilla.suse.com/1125604","tags":["report"]},{"url":"https://bugzilla.suse.com/1126056","tags":["report"]},{"url":"https://bugzilla.suse.com/1127557","tags":["report"]},{"url":"https://bugzilla.suse.com/1130230","tags":["report"]},{"url":"https://bugzilla.suse.com/1132348","tags":["report"]},{"url":"https://bugzilla.suse.com/1132400","tags":["report"]},{"url":"https://bugzilla.suse.com/1132721","tags":["report"]},{"url":"https://bugzilla.suse.com/1133506","tags":["report"]},{"url":"https://bugzilla.suse.com/1133509","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6454","tags":["web"]},{"url":"https://bugzilla.suse.com/SLE-5933","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191364-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-3843","tags":["report"]},{"url":"https://github.com/systemd/systemd-stable/pull/54","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4269-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-16888","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-3844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-20386","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-1712","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-21029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33910","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-3843","description":"It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.","status":"published","published":"2019-04-26T20:27:30Z","modified":"2025-06-09T15:49:53.235Z","cvss":[{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2019-13463","description":"It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.","status":"published","published":"2019-04-26T20:27:30Z","modified":"2025-06-09T15:49:53Z","cvss":[{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:32:27.753525Z"}],"ghsa":[{"id":"GHSA-54p3-x8px-4jp3","title":"It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID...","description":"It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.","status":"published","published":"2022-05-24T16:44:46Z","modified":"2024-04-04T00:11:36Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-266","CWE-269"],"updated_at":"2026-11-02T14:55:49.472376Z"}],"nvd":[{"id":"CVE-2019-3843","description":"It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.","status":"published","published":"2019-04-26T21:29:00.36Z","modified":"2026-06-17T02:35:42.523Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-266","CWE-269"],"updated_at":"2026-11-02T14:05:12.471695Z"}],"osv":[{"id":"CVE-2019-3843","description":"It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.","status":"published","published":"2019-04-26T21:29:00.36Z","modified":"2026-10-24T10:30:57.904184047Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-3843","description":"It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.","status":"published","published":"2019-04-26T21:29:00.36Z","modified":"2026-09-21T07:00:11.66772143Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"RHSA-2020:1794","title":"Red Hat Security Advisory: systemd security, bug fix, and enhancement update","status":"published","published":"2024-09-16T03:03:26Z","modified":"2025-11-22T12:00:27Z","cvss":[{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"UBUNTU-CVE-2019-3843","description":"It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.","status":"published","published":"2019-04-26T21:29:00Z","modified":"2026-04-22T11:57:47.581306Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"CLSA-2025-1763418591","title":"Fix CVE(s): CVE-2019-3843, CVE-2019-3844","description":"   * SECURITY UPDATE: Privilege chaining vulnerability\n     - debian/patches/CVE-2019-3843.patch: introduce functionality\n       for blocking chmod() for suid/sgid files with new unit\n       setting RestrictSUIDSGID=\n     - CVE-2019-3843\n   * SECURITY UPDATE: Privilege chaining vulnerability\n     - debian/patches/CVE-2019-3844.patch: imply NNP and SUID/SGID\n       restriction for DynamicUser=yes service\n     - CVE-2019-3844","status":"published","published":"2025-11-17T22:29:56Z","modified":"2026-06-04T10:03:19.792818Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"openSUSE-SU-2024:11420-1","title":"libsystemd0-249.4-2.2 on GA media","description":"These are all security issues fixed in the libsystemd0-249.4-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:22.858405Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2019:1364-1","title":"Security update for systemd","description":"This update for systemd fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-3842: Fixed a privilege escalation in pam_systemd which could be exploited by a local user (bsc#1132348).\n- CVE-2019-6454: Fixed a denial of service via crafted D-Bus message (bsc#1125352).\n- CVE-2019-3843, CVE-2019-3844: Fixed a privilege escalation where services with DynamicUser could gain new privileges or create SUID/SGID binaries (bsc#1133506, bsc#1133509).\n\nNon-security issued fixed:\n\n- logind: fix killing of scopes (bsc#1125604)\n- namespace: make MountFlags=shared work again (bsc#1124122)\n- rules: load drivers only on 'add' events (bsc#1126056)\n- sysctl: Don't pass null directive argument to '%s' (bsc#1121563)\n- systemd-coredump: generate a stack trace of all core dumps and log into the journal (jsc#SLE-5933)\n- udevd: notify when max number value of children is reached only once per batch of events (bsc#1132400)\n- sd-bus: bump message queue size again (bsc#1132721)\n- Do not automatically online memory on s390x (bsc#1127557)\n- Removed sg.conf (bsc#1036463)\n","status":"published","published":"2019-05-28T08:51:42Z","modified":"2026-02-04T03:30:08.586125Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1364-2","title":"Security update for systemd","description":"This update for systemd fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-3842: Fixed a privilege escalation in pam_systemd which could be exploited by a local user (bsc#1132348).\n- CVE-2019-6454: Fixed a denial of service via crafted D-Bus message (bsc#1125352).\n- CVE-2019-3843, CVE-2019-3844: Fixed a privilege escalation where services with DynamicUser could gain new privileges or create SUID/SGID binaries (bsc#1133506, bsc#1133509).\n\nNon-security issued fixed:\n\n- logind: fix killing of scopes (bsc#1125604)\n- namespace: make MountFlags=shared work again (bsc#1124122)\n- rules: load drivers only on 'add' events (bsc#1126056)\n- sysctl: Don't pass null directive argument to '%s' (bsc#1121563)\n- systemd-coredump: generate a stack trace of all core dumps and log into the journal (jsc#SLE-5933)\n- udevd: notify when max number value of children is reached only once per batch of events (bsc#1132400)\n- sd-bus: bump message queue size again (bsc#1132721)\n- Do not automatically online memory on s390x (bsc#1127557)\n- Removed sg.conf (bsc#1036463)\n","status":"published","published":"2019-07-15T13:48:30Z","modified":"2026-02-04T02:24:46.209032Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-4269-1","title":"systemd vulnerabilities","description":"It was discovered that systemd incorrectly handled certain PIDFile files.\nA local attacker could possibly use this issue to trick systemd into\nkilling privileged processes. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2018-16888)\n\nIt was discovered that systemd incorrectly handled certain udevadm trigger\ncommands. A local attacker could possibly use this issue to cause systemd\nto consume resources, leading to a denial of service. (CVE-2019-20386)\n\nJann Horn discovered that systemd incorrectly handled services that use the\nDynamicUser property. A local attacker could possibly use this issue to\naccess resources owned by a different service in the future. This issue\nonly affected Ubuntu 18.04 LTS. (CVE-2019-3843, CVE-2019-3844)\n\nTavis Ormandy discovered that systemd incorrectly handled certain Polkit\nqueries. A local attacker could use this issue to cause systemd to crash,\nresulting in a denial of service, or possibly execute arbitrary code and\nescalate privileges. (CVE-2020-1712)\n","status":"published","published":"2020-02-05T16:39:46Z","modified":"2026-04-27T15:48:47.521873468Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}