Medium severity5.5OSV Advisory· Published Mar 21, 2019· Updated Jun 17, 2026

CVE-2019-6454

Description

An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Systemd Project/Systemd
cpe:2.3:a:systemd_project:systemd:239:*:*:*:*:*:*:*
OpenSUSE/Leap
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
NetApp/Active Iq Performance Analytics Services
cpe:2.3:a:netapp:active_iq_performance_analytics_services:-:*:*:*:*:*:*:*
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Fedoraproject/Fedora
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
Canonical/Ubuntu Linux3 versions
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*+ 2 more
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server2 versions
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Eus Compute Node
cpe:2.3:o:redhat:enterprise_linux_compute_node_eus:7.5:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Desktop
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Eus6 versions
cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Ibm Z Systems Eus5 versions
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.4:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.1:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Power Big Endian Eus
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.4:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Power Little Endian
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Power Little Endian Eus5 versions
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.4:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Aus5 versions
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions5 versions
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.3:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Tus5 versions
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Update Services For Sap Solutions5 versions
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.3:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Workstation
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
McAfee/Web Gateway
cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*
Range: <7.7.2.21
osv-coords21 versions
pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1 pkg:rpm/opensuse/systemd&distro=openSUSE%20Tumbleweed pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS pkg:rpm/suse/systemd&distro=SUSE%20OpenStack%20Cloud%207 pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4 pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4 pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/systemd&distro=SUSE%20Enterprise%20Storage%204 pkg:rpm/opensuse/systemd&distro=openSUSE%20Leap%2015.0 pkg:rpm/opensuse/systemd-mini&distro=openSUSE%20Leap%2015.0
< 234-24.25.1+ 20 more
- (no CPE)range: < 234-24.25.1
- (no CPE)range: < 234-24.30.1
- (no CPE)range: < 249.4-2.2
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 210-116.22.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 210-116.22.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 210-70.77.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 234-lp150.20.15.1
- (no CPE)range: < 234-lp150.20.15.1
Novell/Suse Linux Enterprise Software Development KitOSV
Range: v1, v10, v11, …
Systemd Project/sd-busllm-create
Range: <239

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2019/02/18/3nvdMailing ListPatchThird Party Advisory
github.com/systemd/systemd/commits/master/src/libsystemd/sd-bus/bus-objects.cnvdPatchThird Party Advisory
kc.mcafee.com/corporate/indexnvdPatchThird Party Advisory
www.openwall.com/lists/oss-security/2021/07/20/2nvdExploitMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-02/msg00070.htmlnvdThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.htmlnvdMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2019/02/19/1nvdMailing ListThird Party Advisory
www.securityfocus.com/bid/107081nvdThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2019:0368nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:0990nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:1322nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:1502nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:2805nvdThird Party Advisory
lists.debian.org/debian-lts-announce/2019/02/msg00031.htmlnvdMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20190327-0004/nvdThird Party Advisory
usn.ubuntu.com/3891-1/nvdThird Party Advisory
www.debian.org/security/2019/dsa-4393nvdThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N67IOBOTDOMVNQJ5QRU2MXLEECXPGNVJ/nvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000