VYPR
Unrated severityNVD Advisory· Published Jan 21, 2020· Updated Jun 9, 2025

CVE-2019-20386

CVE-2019-20386

Description

An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.

Affected products

22

Patches

2
efb536d0cbe2

Update NEWS for v243

https://github.com/systemd/systemdZbigniew Jędrzejewski-SzmekSep 3, 2019via osv
1 file changed · +12 2
  • NEWS+12 2 modified
    @@ -1,6 +1,6 @@
     systemd System and Service Manager
     
    -CHANGES WITH 243 in spe:
    +CHANGES WITH 243:
     
             * This release enables unprivileged programs (i.e. requiring neither
               setuid nor file capabilities) to send ICMP Echo (i.e. ping) requests
    @@ -279,6 +279,16 @@ CHANGES WITH 243 in spe:
               been renamed to LinkLayerAddress=, and it now allows configuration of
               IP addresses, too.
     
    +        * systemd-networkd's handling of the kernel's disable_ipv6 sysctl is
    +          simplified: systemd-networkd will disable the sysctl (enable IPv6) if
    +          IPv6 configuration (static or DHCPv6) was found for a given
    +          interface. It will not touch the sysctl otherwise.
    +
    +        * The order of entries is $PATH used by the user manager instance was
    +          changed to put bin/ entries before the corresponding sbin/ entries.
    +          It is recommended to not rely on this order, and only ever have one
    +          binary with a given name in the system paths under /usr.
    +
             * A new tool systemd-network-generator has been added that may generate
               .network, .netdev and .link files from IP configuration specified on
               the kernel command line in the format used by Dracut.
    @@ -466,7 +476,7 @@ CHANGES WITH 243 in spe:
             Ruoyao, Yuri Chornoivan, Yu Watanabe, Your Name, Zach Smith, Zbigniew
             Jędrzejewski-Szmek, Zhang Xianwei
     
    -        – Somewhere, SOME-TI-ME
    +        – Camerino, 2019-09-03
     
     CHANGES WITH 242:
     
    
b2774a3ae692

bus_open leak sd_event_source when udevadm trigger。

1 file changed · +2 1
  • src/login/logind-button.c+2 1 modified
    @@ -341,7 +341,8 @@ int button_open(Button *b) {
             }
     
             (void) button_set_mask(b);
    -
    +        
    +        b->io_event_source = sd_event_source_unref(b->io_event_source);
             r = sd_event_add_io(b->manager->event, &b->io_event_source, b->fd, EPOLLIN, button_dispatch, b);
             if (r < 0) {
                     log_error_errno(r, "Failed to add button event: %m");
    

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.