CVE-2019-3844 Vulnerability Details

  /     /     /  

CVE-2019-3844 Metadata Quick Info

CVE Published: 26/04/2019 | CVE Updated: 04/08/2024 | CVE Year: 2019
Source: redhat | Vendor: [freedesktop.org] | Product: systemd
Status : PUBLISHED

---

CVE-2019-3844 Description

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-268
CWE Name: CWE-268
Source: [freedesktop.org]

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).