Deserialization of Untrusted Data SNYK-DEBIAN9-SYSTEMD-305096

[github-actions]

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Debian.
See How to fix? for Debian:9 relevant fixed versions and status.

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.

Remediation

Upgrade Debian:9 systemd to version 232-25+deb9u10 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2018-15686
• https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html
• https://www.exploit-db.com/exploits/45714/
• https://security.gentoo.org/glsa/201810-10
• pid1 serialization/deserialization fixes systemd/systemd#10519
• https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://access.redhat.com/errata/RHSA-2019:3222
• https://access.redhat.com/errata/RHSA-2020:0593
• https://access.redhat.com/errata/RHSA-2019:2091
• http://www.securityfocus.com/bid/105747
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-15686
• https://usn.ubuntu.com/3816-1/
• https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E