VDB

CISA-2019-3844

CISA-2019-3844 PUBLISHED CVSS 4.5 MEDIUM

Reported by redhat · Published April 26, 2019

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.

Risk Scores

CVSS 3.0
4.5
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected Products

VendorProductVersions
[freedesktop.org]systemd242
[freedesktop.org]systemd242, 242

Timeline

  • Apr 26, 2019 CVE Published
  • Jun 9, 2025 CVE Updated

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›