Unrated severityOSV Advisory· Published Mar 17, 2019· Updated Aug 4, 2024
CVE-2019-6454
CVE-2019-6454
Description
An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).
Affected products
22- Range: v1, v10, v11, …
- osv-coords21 versionspkg:rpm/opensuse/systemd&distro=openSUSE%20Leap%2015.0pkg:rpm/opensuse/systemd&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/systemd-mini&distro=openSUSE%20Leap%2015.0pkg:rpm/suse/systemd&distro=SUSE%20Enterprise%20Storage%204pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSSpkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSSpkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4pkg:rpm/suse/systemd&distro=SUSE%20OpenStack%20Cloud%207
< 234-lp150.20.15.1+ 20 more
- (no CPE)range: < 234-lp150.20.15.1
- (no CPE)range: < 249.4-2.2
- (no CPE)range: < 234-lp150.20.15.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 234-24.25.1
- (no CPE)range: < 234-24.30.1
- (no CPE)range: < 210-116.22.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 210-70.77.1
- (no CPE)range: < 210-116.22.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
- (no CPE)range: < 228-150.63.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
18- lists.opensuse.org/opensuse-security-announce/2019-02/msg00070.htmlmitrevendor-advisoryx_refsource_SUSE
- lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.htmlmitrevendor-advisoryx_refsource_SUSE
- access.redhat.com/errata/RHSA-2019:0368mitrevendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2019:0990mitrevendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2019:1322mitrevendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2019:1502mitrevendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2019:2805mitrevendor-advisoryx_refsource_REDHAT
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N67IOBOTDOMVNQJ5QRU2MXLEECXPGNVJ/mitrevendor-advisoryx_refsource_FEDORA
- usn.ubuntu.com/3891-1/mitrevendor-advisoryx_refsource_UBUNTU
- www.debian.org/security/2019/dsa-4393mitrevendor-advisoryx_refsource_DEBIAN
- www.openwall.com/lists/oss-security/2019/02/18/3mitremailing-listx_refsource_MLIST
- www.openwall.com/lists/oss-security/2019/02/19/1mitremailing-listx_refsource_MLIST
- www.openwall.com/lists/oss-security/2021/07/20/2mitremailing-listx_refsource_MLIST
- www.securityfocus.com/bid/107081mitrevdb-entryx_refsource_BID
- github.com/systemd/systemd/commits/master/src/libsystemd/sd-bus/bus-objects.cmitrex_refsource_MISC
- kc.mcafee.com/corporate/indexmitrex_refsource_CONFIRM
- lists.debian.org/debian-lts-announce/2019/02/msg00031.htmlmitremailing-listx_refsource_MLIST
- security.netapp.com/advisory/ntap-20190327-0004/mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.