{"id":"CVE-2019-3844","aliases":["CLSA-2025-1763418591","DEBIAN-CVE-2019-3844","EUVD-2019-13464","GHSA-h647-28xp-2hc8","RHSA-2020:1794","SUSE-SU-2019:1364-1","SUSE-SU-2019:1364-2","UBUNTU-CVE-2019-3844","USN-4269-1","openSUSE-SU-2024:11420-1"],"status":"published","title":"It was discovered that a systemd service that uses DynamicUser property can get new privileges...","description":"It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.","severity":{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00915,"percentile":0.60394,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-268"],"published":"2019-04-26T20:26:53Z","modified":"2026-10-24T10:30:23Z","exploits":[{"source":"exploitdb","id":"EDB-46760","title":"systemd - DynamicUser can Create setuid Binaries when Assisted by Another Process","type":"dos","platform":"linux","date":"2019-04-26","verified":true,"url":"https://www.exploit-db.com/exploits/46760"}],"fixes":[{"ecosystem":"Debian:12","package":"systemd","fixed_in":["242-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"systemd","fixed_in":["242-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"systemd","fixed_in":["242-4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"systemd","fixed_in":["237-3ubuntu10.38"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnss-myhostname","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnss-mymachines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnss-resolve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnss-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libpam-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libsystemd-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libsystemd0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libudev-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libudev1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"systemd-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"systemd-coredump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"systemd-journal-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"systemd-sysv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"systemd-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"udev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"241-7~deb10u10+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"242-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"242-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"242-4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-container-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-journal-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-journal-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-pam-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-udev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"systemd-udev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:239-29.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"234-24.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"234-24.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"237-3ubuntu10.38"}]}],"versions":["234-2ubuntu12","235-2ubuntu3","235-3ubuntu2","235-3ubuntu3","237-3ubuntu3","237-3ubuntu4","237-3ubuntu6","237-3ubuntu7","237-3ubuntu8","237-3ubuntu10","237-3ubuntu10.2","237-3ubuntu10.3","237-3ubuntu10.4","237-3ubuntu10.6","237-3ubuntu10.9","237-3ubuntu10.11","237-3ubuntu10.12","237-3ubuntu10.13","237-3ubuntu10.15","237-3ubuntu10.17","237-3ubuntu10.19","237-3ubuntu10.20","237-3ubuntu10.21","237-3ubuntu10.22","237-3ubuntu10.23","237-3ubuntu10.24","237-3ubuntu10.25","237-3ubuntu10.26","237-3ubuntu10.28","237-3ubuntu10.29","237-3ubuntu10.31","237-3ubuntu10.33"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"229-4ubuntu21.27"}]}],"versions":["225-1ubuntu9","227-2ubuntu1","227-2ubuntu2","228-1ubuntu2","228-2ubuntu1","228-2ubuntu2","228-3ubuntu1","228-4ubuntu1","228-4ubuntu2","228-5ubuntu1","228-5ubuntu2","228-5ubuntu3","228-6ubuntu1","229-1ubuntu2","229-1ubuntu4","229-2ubuntu1","229-3ubuntu1","229-3ubuntu2","229-4ubuntu1","229-4ubuntu4","229-4ubuntu5","229-4ubuntu6","229-4ubuntu7","229-4ubuntu8","229-4ubuntu10","229-4ubuntu11","229-4ubuntu12","229-4ubuntu13","229-4ubuntu16","229-4ubuntu17","229-4ubuntu19","229-4ubuntu20","229-4ubuntu21","229-4ubuntu21.1","229-4ubuntu21.2","229-4ubuntu21.3","229-4ubuntu21.4","229-4ubuntu21.5","229-4ubuntu21.6","229-4ubuntu21.8","229-4ubuntu21.9","229-4ubuntu21.10","229-4ubuntu21.15","229-4ubuntu21.16","229-4ubuntu21.17","229-4ubuntu21.19","229-4ubuntu21.21","229-4ubuntu21.22","229-4ubuntu21.23"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"237-3ubuntu10.38"}]}],"versions":["234-2ubuntu12","235-2ubuntu3","235-3ubuntu2","235-3ubuntu3","237-3ubuntu3","237-3ubuntu4","237-3ubuntu6","237-3ubuntu7","237-3ubuntu8","237-3ubuntu10","237-3ubuntu10.2","237-3ubuntu10.3","237-3ubuntu10.4","237-3ubuntu10.6","237-3ubuntu10.9","237-3ubuntu10.11","237-3ubuntu10.12","237-3ubuntu10.13","237-3ubuntu10.15","237-3ubuntu10.17","237-3ubuntu10.19","237-3ubuntu10.20","237-3ubuntu10.21","237-3ubuntu10.22","237-3ubuntu10.23","237-3ubuntu10.24","237-3ubuntu10.25","237-3ubuntu10.26","237-3ubuntu10.28","237-3ubuntu10.29","237-3ubuntu10.31","237-3ubuntu10.33"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"249.4-2.2"}]}],"bundled":19}],"products":[{"vendor":"[freedesktop.org]","product":"systemd"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"netapp","product":"cn1610_firmware"},{"vendor":"netapp","product":"hci_management_node"},{"vendor":"netapp","product":"snapprotect"},{"vendor":"netapp","product":"solidfire"},{"vendor":"systemd","product":"systemd"},{"vendor":"systemd_project","product":"systemd"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3844","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/108096","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190619-0002/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4269-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3844","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://security.netapp.com/advisory/ntap-20190619-0002"},{"url":"https://usn.ubuntu.com/4269-1"},{"url":"https://github.com/advisories/GHSA-h647-28xp-2hc8"},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2025-1763418591.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-3844","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1794","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1684607","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1684610","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1689346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1696602","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1717603","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1719577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1724617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734787","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1735787","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1743235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1748258","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1749212","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1752050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1753369","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1762679","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1763155","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1763161","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1763619","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1770189","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1776408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1777110","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1778384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1808940","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1794.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3843","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3843","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3843","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3844","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3844","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191364-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1036463","tags":["report"]},{"url":"https://bugzilla.suse.com/1121563","tags":["report"]},{"url":"https://bugzilla.suse.com/1124122","tags":["report"]},{"url":"https://bugzilla.suse.com/1125352","tags":["report"]},{"url":"https://bugzilla.suse.com/1125604","tags":["report"]},{"url":"https://bugzilla.suse.com/1126056","tags":["report"]},{"url":"https://bugzilla.suse.com/1127557","tags":["report"]},{"url":"https://bugzilla.suse.com/1130230","tags":["report"]},{"url":"https://bugzilla.suse.com/1132348","tags":["report"]},{"url":"https://bugzilla.suse.com/1132400","tags":["report"]},{"url":"https://bugzilla.suse.com/1132721","tags":["report"]},{"url":"https://bugzilla.suse.com/1133506","tags":["report"]},{"url":"https://bugzilla.suse.com/1133509","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6454","tags":["web"]},{"url":"https://bugzilla.suse.com/SLE-5933","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191364-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-3844","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4269-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-16888","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-3843","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-20386","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-1712","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-21029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33910","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-3844","description":"It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.","status":"published","published":"2019-04-26T20:26:53Z","modified":"2025-06-09T15:49:20.11Z","cvss":[{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-268"],"updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2019-13464","description":"It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.","status":"published","published":"2019-04-26T20:26:53Z","modified":"2025-06-09T15:49:20Z","cvss":[{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:32:27.753525Z"}],"ghsa":[{"id":"GHSA-h647-28xp-2hc8","title":"It was discovered that a systemd service that uses DynamicUser property can get new privileges...","description":"It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.","status":"published","published":"2022-05-24T16:44:46Z","modified":"2024-04-04T00:11:51Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-268"],"updated_at":"2026-11-02T14:55:49.472376Z"}],"nvd":[{"id":"CVE-2019-3844","description":"It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.","status":"published","published":"2019-04-26T21:29:00.423Z","modified":"2026-06-17T02:35:42.68Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-268"],"updated_at":"2026-11-02T14:05:12.471695Z"}],"osv":[{"id":"CVE-2019-3844","description":"It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.","status":"published","published":"2019-04-26T21:29:00.423Z","modified":"2026-10-24T10:30:23.500296803Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-3844","description":"It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.","status":"published","published":"2019-04-26T21:29:00.423Z","modified":"2026-09-21T07:03:18.827422142Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"RHSA-2020:1794","title":"Red Hat Security Advisory: systemd security, bug fix, and enhancement update","status":"published","published":"2024-09-16T03:03:26Z","modified":"2025-11-22T12:00:27Z","cvss":[{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"UBUNTU-CVE-2019-3844","description":"It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.","status":"published","published":"2019-04-26T21:29:00Z","modified":"2026-04-22T11:56:56.265914Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":4.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"CLSA-2025-1763418591","title":"Fix CVE(s): CVE-2019-3843, CVE-2019-3844","description":"   * SECURITY UPDATE: Privilege chaining vulnerability\n     - debian/patches/CVE-2019-3843.patch: introduce functionality\n       for blocking chmod() for suid/sgid files with new unit\n       setting RestrictSUIDSGID=\n     - CVE-2019-3843\n   * SECURITY UPDATE: Privilege chaining vulnerability\n     - debian/patches/CVE-2019-3844.patch: imply NNP and SUID/SGID\n       restriction for DynamicUser=yes service\n     - CVE-2019-3844","status":"published","published":"2025-11-17T22:29:56Z","modified":"2026-06-04T10:03:19.792818Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"openSUSE-SU-2024:11420-1","title":"libsystemd0-249.4-2.2 on GA media","description":"These are all security issues fixed in the libsystemd0-249.4-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:22.858405Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2019:1364-1","title":"Security update for systemd","description":"This update for systemd fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-3842: Fixed a privilege escalation in pam_systemd which could be exploited by a local user (bsc#1132348).\n- CVE-2019-6454: Fixed a denial of service via crafted D-Bus message (bsc#1125352).\n- CVE-2019-3843, CVE-2019-3844: Fixed a privilege escalation where services with DynamicUser could gain new privileges or create SUID/SGID binaries (bsc#1133506, bsc#1133509).\n\nNon-security issued fixed:\n\n- logind: fix killing of scopes (bsc#1125604)\n- namespace: make MountFlags=shared work again (bsc#1124122)\n- rules: load drivers only on 'add' events (bsc#1126056)\n- sysctl: Don't pass null directive argument to '%s' (bsc#1121563)\n- systemd-coredump: generate a stack trace of all core dumps and log into the journal (jsc#SLE-5933)\n- udevd: notify when max number value of children is reached only once per batch of events (bsc#1132400)\n- sd-bus: bump message queue size again (bsc#1132721)\n- Do not automatically online memory on s390x (bsc#1127557)\n- Removed sg.conf (bsc#1036463)\n","status":"published","published":"2019-05-28T08:51:42Z","modified":"2026-02-04T03:30:08.586125Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1364-2","title":"Security update for systemd","description":"This update for systemd fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-3842: Fixed a privilege escalation in pam_systemd which could be exploited by a local user (bsc#1132348).\n- CVE-2019-6454: Fixed a denial of service via crafted D-Bus message (bsc#1125352).\n- CVE-2019-3843, CVE-2019-3844: Fixed a privilege escalation where services with DynamicUser could gain new privileges or create SUID/SGID binaries (bsc#1133506, bsc#1133509).\n\nNon-security issued fixed:\n\n- logind: fix killing of scopes (bsc#1125604)\n- namespace: make MountFlags=shared work again (bsc#1124122)\n- rules: load drivers only on 'add' events (bsc#1126056)\n- sysctl: Don't pass null directive argument to '%s' (bsc#1121563)\n- systemd-coredump: generate a stack trace of all core dumps and log into the journal (jsc#SLE-5933)\n- udevd: notify when max number value of children is reached only once per batch of events (bsc#1132400)\n- sd-bus: bump message queue size again (bsc#1132721)\n- Do not automatically online memory on s390x (bsc#1127557)\n- Removed sg.conf (bsc#1036463)\n","status":"published","published":"2019-07-15T13:48:30Z","modified":"2026-02-04T02:24:46.209032Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-4269-1","title":"systemd vulnerabilities","description":"It was discovered that systemd incorrectly handled certain PIDFile files.\nA local attacker could possibly use this issue to trick systemd into\nkilling privileged processes. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2018-16888)\n\nIt was discovered that systemd incorrectly handled certain udevadm trigger\ncommands. A local attacker could possibly use this issue to cause systemd\nto consume resources, leading to a denial of service. (CVE-2019-20386)\n\nJann Horn discovered that systemd incorrectly handled services that use the\nDynamicUser property. A local attacker could possibly use this issue to\naccess resources owned by a different service in the future. This issue\nonly affected Ubuntu 18.04 LTS. (CVE-2019-3843, CVE-2019-3844)\n\nTavis Ormandy discovered that systemd incorrectly handled certain Polkit\nqueries. A local attacker could use this issue to cause systemd to crash,\nresulting in a denial of service, or possibly execute arbitrary code and\nescalate privileges. (CVE-2020-1712)\n","status":"published","published":"2020-02-05T16:39:46Z","modified":"2026-04-27T15:48:47.521873468Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}