An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2091 advisory.

    - core: when deserializing state always use read_line(, LONG_LINE_MAX, ) (CVE-2018-15686)
    - dhcp6: make sure we have enough space for the DHCP6 option header (CVE-2018-15688)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.11.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.11.2 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.10.9. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.10.9 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.16. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.16 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was discovered systemd does not correctly check the     content of PIDFile files before using it to kill     processes. When a service is run from an unprivileged     user (e.g. User field set in the service file), a local     attacker who is able to write to the PIDFile of the     mentioned service may use this flaw to trick systemd     into killing other services and/or privileged     processes. Versions before v237 are     vulnerable.(CVE-2018-16888)

  - An out of bounds read was discovered in     systemd-journald in the way it parses log messages that     terminate with a colon ':'. A local attacker can use     this flaw to disclose process memory data. Versions     from v221 to v239 are vulnerable.(CVE-2018-16866)

  - A vulnerability in unit_deserialize of systemd allows     an attacker to supply arbitrary state across systemd     re-execution via NotifyAccess. This can be used to     improperly influence systemd execution and possibly     lead to root privilege escalation. Affected releases     are systemd versions up to and including     239.(CVE-2018-15686)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1264 advisory.

    The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and     LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for     starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups.
    In addition, it supports snapshotting and restoring of the system state, maintains mount and automount     points, and implements an elaborate transactional dependency-based service control logic. It can also work     as a drop-in replacement for sysvinit.

    Security Fix(es):

    * systemd: line splitting via fgets() allows for state injection during daemon-reexec (CVE-2018-15686)

    * systemd: out-of-bounds read when parsing a crafted syslog message (CVE-2018-16866)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Restarting systemd-journald to load new configurations causes other daemons stop working (BZ#1798160)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the systemd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - It was discovered systemd does not correctly check the     content of PIDFile files before using it to kill     processes. When a service is run from an unprivileged     user (e.g. User field set in the service file), a local     attacker who is able to write to the PIDFile of the     mentioned service may use this flaw to trick systemd     into killing other services and/or privileged     processes. Versions before v237 are     vulnerable.(CVE-2018-16888)

  - An out of bounds read was discovered in     systemd-journald in the way it parses log messages that     terminate with a colon ':'. A local attacker can use     this flaw to disclose process memory data. Versions     from v221 to v239 are vulnerable.(CVE-2018-16866)

  - It was discovered that systemd is vulnerable to a state     injection attack when deserializing the state of a     service. Properties longer than LINE_MAX are not     correctly parsed and an attacker may abuse this flaw in     particularly configured services to inject, change, or     corrupt the service state.(CVE-2018-15686)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0593 advisory.

    The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and     LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for     starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups.
    In addition, it supports snapshotting and restoring of the system state, maintains mount and automount     points, and implements an elaborate transactional dependency-based service control logic. It can also work     as a drop-in replacement for sysvinit.

    Security Fix(es):

    * systemd: line splitting via fgets() allows for state injection during daemon-reexec (CVE-2018-15686)

    * systemd: out-of-bounds read when parsing a crafted syslog message (CVE-2018-16866)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has systemd packages installed that are affected by multiple vulnerabilities:

  - A vulnerability in unit_deserialize of systemd allows an     attacker to supply arbitrary state across systemd re-     execution via NotifyAccess. This can be used to     improperly influence systemd execution and possibly lead     to root privilege escalation. Affected releases are     systemd versions up to and including 239.
    (CVE-2018-15686)

  - It was discovered systemd does not correctly check the     content of PIDFile files before using it to kill     processes. When a service is run from an unprivileged     user (e.g. User field set in the service file), a local     attacker who is able to write to the PIDFile of the     mentioned service may use this flaw to trick systemd     into killing other services and/or privileged processes.
    Versions before v237 are vulnerable. (CVE-2018-16888)

  - An out of bounds read was discovered in systemd-journald     in the way it parses log messages that terminate with a     colon ':'. A local attacker can use this flaw to     disclose process memory data. Versions from v221 to v239     are vulnerable. (CVE-2018-16866)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered systemd does not correctly check the     content of PIDFile files before using it to kill     processes. When a service is run from an unprivileged     user (e.g. User field set in the service file), a local     attacker who is able to write to the PIDFile of the     mentioned service may use this flaw to trick systemd     into killing other services and/or privileged     processes. Versions before v237 are     vulnerable.(CVE-2018-16888)

  - A vulnerability in unit_deserialize of systemd allows     an attacker to supply arbitrary state across systemd     re-execution via NotifyAccess. This can be used to     improperly influence systemd execution and possibly     lead to root privilege escalation. Affected releases     are systemd versions up to and including     239.(CVE-2018-15686)

  - An out of bounds read was discovered in     systemd-journald in the way it parses log messages that     terminate with a colon ':'. A local attacker can use     this flaw to disclose process memory data. Versions     from v221 to v239 are vulnerable.(CVE-2018-16866)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3222 advisory.

    The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and     LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for     starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups.
    In addition, it supports snapshotting and restoring of the system state, maintains mount and automount     points, and implements an elaborate transactional dependency-based service control logic. It can also work     as a drop-in replacement for sysvinit.

    Security Fix(es):

    * systemd: line splitting via fgets() allows for state injection during daemon-reexec (CVE-2018-15686)

    * systemd: out-of-bounds read when parsing a crafted syslog message (CVE-2018-16866)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Layered slices are left in a dead state if slices are stopped that have child slices underneath     (BZ#1729227)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has systemd packages installed that are affected by multiple vulnerabilities:

  - A vulnerability in unit_deserialize of systemd allows an     attacker to supply arbitrary state across systemd re-     execution via NotifyAccess. This can be used to     improperly influence systemd execution and possibly lead     to root privilege escalation. Affected releases are     systemd versions up to and including 239.
    (CVE-2018-15686)

  - It was discovered systemd does not correctly check the     content of PIDFile files before using it to kill     processes. When a service is run from an unprivileged     user (e.g. User field set in the service file), a local     attacker who is able to write to the PIDFile of the     mentioned service may use this flaw to trick systemd     into killing other services and/or privileged processes.
    Versions before v237 are vulnerable. (CVE-2018-16888)

  - An out of bounds read was discovered in systemd-journald     in the way it parses log messages that terminate with a     colon ':'. A local attacker can use this flaw to     disclose process memory data. Versions from v221 to v239     are vulnerable. (CVE-2018-16866)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It has been discovered that systemd-tmpfiles mishandles     symbolic links present in non-terminal path components.
    In some configurations a local user could use this     vulnerability to get access to arbitrary files when the     systemd-tmpfiles command is run.(CVE-2018-6954)

  - An out of bounds read was discovered in     systemd-journald in the way it parses log messages that     terminate with a colon ':'. A local attacker can use     this flaw to disclose process memory     data.(CVE-2018-16866)

  - A vulnerability in unit_deserialize of systemd allows     an attacker to supply arbitrary state across systemd     re-execution via NotifyAccess. This can be used to     improperly influence systemd execution and possibly     lead to root privilege escalation. (CVE-2018-15686)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for systemd is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es) :

* systemd: line splitting via fgets() allows for state injection during daemon-reexec (CVE-2018-15686)

* systemd: out-of-bounds read when parsing a crafted syslog message (CVE-2018-16866)

* systemd: kills privileged process if unprivileged PIDFile was tampered (CVE-2018-16888)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Security Fix(es) :

  - systemd: line splitting via fgets() allows for state     injection during daemon-reexec (CVE-2018-15686)

  - systemd: out-of-bounds read when parsing a crafted     syslog message (CVE-2018-16866)

  - systemd: kills privileged process if unprivileged     PIDFile was tampered (CVE-2018-16888)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2091 advisory.

    The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and     LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for     starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups.
    In addition, it supports snapshotting and restoring of the system state, maintains mount and automount     points, and implements an elaborate transactional dependency-based service control logic. It can also work     as a drop-in replacement for sysvinit.

    Security Fix(es):

    * systemd: line splitting via fgets() allows for state injection during daemon-reexec (CVE-2018-15686)

    * systemd: out-of-bounds read when parsing a crafted syslog message (CVE-2018-16866)

    * systemd: kills privileged process if unprivileged PIDFile was tampered (CVE-2018-16888)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An out of bounds read was discovered in     systemd-journald in the way it parses log messages that     terminate with a colon ':'. A local attacker can use     this flaw to disclose process memory     data.(CVE-2018-16866)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201903-07 (systemd: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in systemd. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker could cause a Denial of Service condition or possibly       execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

This update for systemd provides the following fixes :

Security issues fixed :

  - CVE-2018-16864, CVE-2018-16865: Fixed two memory     corruptions through attacker-controlled alloca()s     (bsc#1120323)

  - CVE-2018-16866: Fixed an information leak in journald     (bsc#1120323)

  - CVE-2018-6954: Fix mishandling of symlinks present in     non-terminal path components (bsc#1080919)

  - Fixed an issue during system startup in relation to     encrypted swap disks (bsc#1119971)

Non-security issues fixed :

  - pam_systemd: Fix 'Cannot create session: Already running     in a session' (bsc#1111498)

  - systemd-vconsole-setup: vconsole setup fails, fonts will     not be copied to tty (bsc#1114933)

  - systemd-tmpfiles-setup: symlinked /tmp to /var/tmp     breaking multiple units (bsc#1045723)

  - Fixed installation issue with /etc/machine-id during     update (bsc#1117063)

  - btrfs: qgroups are assigned to parent qgroups after     reboot (bsc#1093753)

  - logind: Stop managing VT switches if no sessions are     registered on that VT. (bsc#1101591)

  - udev: Downgrade message when settting inotify watch up     fails. (bsc#1005023)

  - udev: Ignore the exit code of systemd-detect-virt for     memory hot-add. In SLE-12-SP3, 80-hotplug-cpu-mem.rules     has a memory hot-add rule that uses systemd-detect-virt     to detect non-zvm environment. The systemd-detect-virt     returns exit failure code when it detected _none_ state.
    The exit failure code causes that the hot-add memory     block can not be set to online. (bsc#1076696) This     update was imported from the SUSE:SLE-15:Update update     project.

This update for systemd provides the following fixes :

Security issues fixed :

  - CVE-2018-16864, CVE-2018-16865: Fixed two memory     corruptions through attacker-controlled alloca()s     (bsc#1120323)

  - CVE-2018-16866: Fixed an information leak in journald     (bsc#1120323)

  - Fixed an issue during system startup in relation to     encrypted swap disks (bsc#1119971)

Non-security issues fixed :

  - core: Queue loading transient units after setting their     properties. (bsc#1115518)

  - logind: Stop managing VT switches if no sessions are     registered on that VT. (bsc#1101591)

  - terminal-util: introduce vt_release() and vt_restore()     helpers.

  - terminal: Unify code for resetting kbd utf8 mode a bit.

  - terminal Reset should honour default_utf8 kernel     setting.

  - logind: Make session_restore_vt() static.

  - udev: Downgrade message when settting inotify watch up     fails. (bsc#1005023)

  - log: Never log into foreign fd #2 in PID 1 or its     pre-execve() children. (bsc#1114981)

  - udev: Ignore the exit code of systemd-detect-virt for     memory hot-add. In SLE-12-SP3, 80-hotplug-cpu-mem.rules     has a memory hot-add rule that uses systemd-detect-virt     to detect non-zvm environment. The systemd-detect-virt     returns exit failure code when it detected _none_ state.
    The exit failure code causes that the hot-add memory     block can not be set to online. (bsc#1076696)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for systemd provides the following fixes :

Security issues fixed :

CVE-2018-16864, CVE-2018-16865: Fixed two memory corruptions through attacker-controlled alloca()s (bsc#1120323)

CVE-2018-16866: Fixed an information leak in journald (bsc#1120323)

CVE-2018-6954: Fix mishandling of symlinks present in non-terminal path components (bsc#1080919)

Fixed an issue during system startup in relation to encrypted swap disks (bsc#1119971)

Non-security issues fixed: pam_systemd: Fix 'Cannot create session:
Already running in a session' (bsc#1111498)

systemd-vconsole-setup: vconsole setup fails, fonts will not be copied to tty (bsc#1114933)

systemd-tmpfiles-setup: symlinked /tmp to /var/tmp breaking multiple units (bsc#1045723)

Fixed installation issue with /etc/machine-id during update (bsc#1117063)

btrfs: qgroups are assigned to parent qgroups after reboot (bsc#1093753)

logind: Stop managing VT switches if no sessions are registered on that VT. (bsc#1101591)

udev: Downgrade message when settting inotify watch up fails.
(bsc#1005023)

udev: Ignore the exit code of systemd-detect-virt for memory hot-add.
In SLE-12-SP3, 80-hotplug-cpu-mem.rules has a memory hot-add rule that uses systemd-detect-virt to detect non-zvm environment. The systemd-detect-virt returns exit failure code when it detected _none_ state. The exit failure code causes that the hot-add memory block can not be set to online. (bsc#1076696)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for systemd provides the following fixes :

Security issues fixed :

CVE-2018-16864, CVE-2018-16865: Fixed two memory corruptions through attacker-controlled alloca()s (bsc#1120323)

CVE-2018-16866: Fixed an information leak in journald (bsc#1120323)

Fixed an issue during system startup in relation to encrypted swap disks (bsc#1119971)

Non-security issues fixed: core: Queue loading transient units after setting their properties. (bsc#1115518)

logind: Stop managing VT switches if no sessions are registered on that VT. (bsc#1101591)

terminal-util: introduce vt_release() and vt_restore() helpers.

terminal: Unify code for resetting kbd utf8 mode a bit.

terminal Reset should honour default_utf8 kernel setting.

logind: Make session_restore_vt() static.

udev: Downgrade message when settting inotify watch up fails.
(bsc#1005023)

log: Never log into foreign fd #2 in PID 1 or its pre-execve() children. (bsc#1114981)

udev: Ignore the exit code of systemd-detect-virt for memory hot-add.
In SLE-12-SP3, 80-hotplug-cpu-mem.rules has a memory hot-add rule that uses systemd-detect-virt to detect non-zvm environment. The systemd-detect-virt returns exit failure code when it detected _none_ state. The exit failure code causes that the hot-add memory block can not be set to online. (bsc#1076696)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3855-1 advisory.

    It was discovered that systemd-journald allocated variable-length buffers for certain message fields on     the stack. A local attacker could potentially exploit this to cause a denial of service, or execute     arbitrary code. (CVE-2018-16864)

    It was discovered that systemd-journald allocated variable-length arrays of objects representing message     fields on the stack. A local attacker could potentially exploit this to cause a denial of service, or     execute arbitrary code. (CVE-2018-16865)

    An out-of-bounds read was discovered in systemd-journald. A local attacker could potentially exploit this     to obtain sensitive information and bypass ASLR protections. (CVE-2018-16866)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- systemd-journald and systemd-journal-remote reject     entries which contain too many fields (CVE-2018-16865,     #1664973) and set limits on the process' command line     length (CVE-2018-16864, #1664972)

  - Fix out-of-bounds read when parsing a crafted syslog     message in systemd-journald (CVE-2018-16866, #1664975)

  - A signal is again used to stop user sessions instead of     dbus (#1664491)

No need to log out or reboot.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Qualys Research Labs discovered multiple vulnerabilities in systemd-journald. Two memory corruption flaws, via attacker-controlled allocations using the alloca function (CVE-2018-16864, CVE-2018-16865 ) and an out-of-bounds read flaw leading to an information leak (CVE-2018-16866 ), could allow an attacker to cause a denial of service or the execution of arbitrary code.

Further details in the Qualys Security Advisory at https://www.qualys.com/2019/01/09/system-down/system-down.txt

Large syslogd messages sent to journald can cause stack corruption, causing journald to crash. The version of systemd on Amazon Linux 2 is not vulnerable to privilege escalation in this case. (CVE-2018-16864)

Large native messages to journald can cause stack corruption, leading to possible local privilege escalation.(CVE-2018-16865)

Please note, if you have systemd-journald-remote configured over http, then you could be open to remote escalation on previous versions of the systemd package. The systemd-journald-remote service is not installed by default on Amazon Linux 2, and when installed and enabled, the default configuration is to use https. (CVE-2018-16865)

An out-of-bounds read in journald, triggered by a specially crafted message, can be used to leak information through the journal file (CVE-2018-16866)

ID	Name	Product	Family	Severity
180808	Oracle Linux 7 : systemd (ELSA-2019-2091)	Nessus	Oracle Linux Local Security Checks	high
164608	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.2)	Nessus	Misc.	critical
164581	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.10.9)	Nessus	Misc.	critical
164573	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16)	Nessus	Misc.	critical
135613	EulerOS Virtualization 3.0.2.2 : systemd (EulerOS-SA-2020-1451)	Nessus	Huawei Local Security Checks	high
135087	RHEL 7 : systemd (RHSA-2020:1264)	Nessus	Red Hat Local Security Checks	high
134505	EulerOS Virtualization for ARM 64 3.0.2.0 : systemd (EulerOS-SA-2020-1216)	Nessus	Huawei Local Security Checks	high
134065	RHEL 7 : systemd (RHSA-2020:0593)	Nessus	Red Hat Local Security Checks	high
132460	NewStart CGSL CORE 5.05 / MAIN 5.05 : systemd Multiple Vulnerabilities (NS-SA-2019-0242)	Nessus	NewStart CGSL Local Security Checks	high
130694	EulerOS 2.0 SP5 : systemd (EulerOS-SA-2019-2232)	Nessus	Huawei Local Security Checks	high
130377	RHEL 7 : systemd (RHSA-2019:3222)	Nessus	Red Hat Local Security Checks	high
129929	NewStart CGSL CORE 5.04 / MAIN 5.04 : systemd Multiple Vulnerabilities (NS-SA-2019-0196)	Nessus	NewStart CGSL Local Security Checks	high
129191	EulerOS 2.0 SP3 : systemd (EulerOS-SA-2019-1998)	Nessus	Huawei Local Security Checks	high
128350	CentOS 7 : systemd (CESA-2019:2091)	Nessus	CentOS Local Security Checks	high
128265	Scientific Linux Security Update : systemd on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	high
127669	RHEL 7 : systemd (RHSA-2019:2091)	Nessus	Red Hat Local Security Checks	high
126875	EulerOS 2.0 SP2 : systemd (EulerOS-SA-2019-1748)	Nessus	Huawei Local Security Checks	low
122735	GLSA-201903-07 : systemd: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
121464	openSUSE Security Update : systemd (openSUSE-2019-98)	Nessus	SuSE Local Security Checks	high
121463	openSUSE Security Update : systemd (openSUSE-2019-97)	Nessus	SuSE Local Security Checks	high
121304	SUSE SLED15 / SLES15 Security Update : systemd (SUSE-SU-2019:0137-1)	Nessus	SuSE Local Security Checks	high
121303	SUSE SLED12 / SLES12 Security Update : systemd (SUSE-SU-2019:0135-1)	Nessus	SuSE Local Security Checks	high
121161	Ubuntu 16.04 LTS / 18.04 LTS : systemd vulnerabilities (USN-3855-1)	Nessus	Ubuntu Local Security Checks	high
121138	Fedora 29 : systemd (2019-18b3a10c7f)	Nessus	Fedora Local Security Checks	high
121136	Debian DSA-4367-1 : systemd - security update	Nessus	Debian Local Security Checks	high
121050	Amazon Linux 2 : systemd (ALAS-2019-1141)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2018-16866

low

Tenable Plugins

high

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

low

high

high

high

high

high

high

high

high

high