It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2091 advisory.

  - An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate     with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221     to v239 are vulnerable. (CVE-2018-16866)

  - It was discovered systemd does not correctly check the content of PIDFile files before using it to kill     processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a     local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick     systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.
    (CVE-2018-16888)

  - A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd     re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly     lead to root privilege escalation. Affected releases are systemd versions up to and including 239.
    (CVE-2018-15686)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was discovered systemd does not correctly check the     content of PIDFile files before using it to kill     processes. When a service is run from an unprivileged     user (e.g. User field set in the service file), a local     attacker who is able to write to the PIDFile of the     mentioned service may use this flaw to trick systemd     into killing other services and/or privileged     processes. Versions before v237 are     vulnerable.(CVE-2018-16888)

  - An out of bounds read was discovered in     systemd-journald in the way it parses log messages that     terminate with a colon ':'. A local attacker can use     this flaw to disclose process memory data. Versions     from v221 to v239 are vulnerable.(CVE-2018-16866)

  - A vulnerability in unit_deserialize of systemd allows     an attacker to supply arbitrary state across systemd     re-execution via NotifyAccess. This can be used to     improperly influence systemd execution and possibly     lead to root privilege escalation. Affected releases     are systemd versions up to and including     239.(CVE-2018-15686)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the systemd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - It was discovered systemd does not correctly check the     content of PIDFile files before using it to kill     processes. When a service is run from an unprivileged     user (e.g. User field set in the service file), a local     attacker who is able to write to the PIDFile of the     mentioned service may use this flaw to trick systemd     into killing other services and/or privileged     processes. Versions before v237 are     vulnerable.(CVE-2018-16888)

  - An out of bounds read was discovered in     systemd-journald in the way it parses log messages that     terminate with a colon ':'. A local attacker can use     this flaw to disclose process memory data. Versions     from v221 to v239 are vulnerable.(CVE-2018-16866)

  - It was discovered that systemd is vulnerable to a state     injection attack when deserializing the state of a     service. Properties longer than LINE_MAX are not     correctly parsed and an attacker may abuse this flaw in     particularly configured services to inject, change, or     corrupt the service state.(CVE-2018-15686)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that systemd incorrectly handled certain PIDFile files. A local attacker could possibly use this issue to trick systemd into killing privileged processes. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-16888)

It was discovered that systemd incorrectly handled certain udevadm trigger commands. A local attacker could possibly use this issue to cause systemd to consume resources, leading to a denial of service.
(CVE-2019-20386)

Jann Horn discovered that systemd incorrectly handled services that use the DynamicUser property. A local attacker could possibly use this issue to access resources owned by a different service in the future.
This issue only affected Ubuntu 18.04 LTS. (CVE-2019-3843, CVE-2019-3844)

Tavis Ormandy discovered that systemd incorrectly handled certain Polkit queries. A local attacker could use this issue to cause systemd to crash, resulting in a denial of service, or possibly execute arbitrary code and escalate privileges. (CVE-2020-1712).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has systemd packages installed that are affected by multiple vulnerabilities:

  - A vulnerability in unit_deserialize of systemd allows an     attacker to supply arbitrary state across systemd re-     execution via NotifyAccess. This can be used to     improperly influence systemd execution and possibly lead     to root privilege escalation. Affected releases are     systemd versions up to and including 239.
    (CVE-2018-15686)

  - It was discovered systemd does not correctly check the     content of PIDFile files before using it to kill     processes. When a service is run from an unprivileged     user (e.g. User field set in the service file), a local     attacker who is able to write to the PIDFile of the     mentioned service may use this flaw to trick systemd     into killing other services and/or privileged processes.
    Versions before v237 are vulnerable. (CVE-2018-16888)

  - An out of bounds read was discovered in systemd-journald     in the way it parses log messages that terminate with a     colon ':'. A local attacker can use this flaw to     disclose process memory data. Versions from v221 to v239     are vulnerable. (CVE-2018-16866)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was discovered systemd does not correctly check the     content of PIDFile files before using it to kill     processes. When a service is run from an unprivileged     user (e.g. User field set in the service file), a local     attacker who is able to write to the PIDFile of the     mentioned service may use this flaw to trick systemd     into killing other services and/or privileged     processes. Versions before v237 are     vulnerable.(CVE-2018-16888)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered systemd does not correctly check the     content of PIDFile files before using it to kill     processes. When a service is run from an unprivileged     user (e.g. User field set in the service file), a local     attacker who is able to write to the PIDFile of the     mentioned service may use this flaw to trick systemd     into killing other services and/or privileged     processes. Versions before v237 are     vulnerable.(CVE-2018-16888)

  - In systemd prior to 234 a race condition exists between     .mount and .automount units such that automount     requests from kernel may not be serviced by systemd     resulting in kernel holding the mountpoint and any     processes that try to use said mount will hang. A race     condition like this may lead to denial of service,     until mount points are unmounted.(CVE-2018-1049)

  - A vulnerability in unit_deserialize of systemd allows     an attacker to supply arbitrary state across systemd     re-execution via NotifyAccess. This can be used to     improperly influence systemd execution and possibly     lead to root privilege escalation. Affected releases     are systemd versions up to and including     239.(CVE-2018-15686)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered systemd does not correctly check the     content of PIDFile files before using it to kill     processes. When a service is run from an unprivileged     user (e.g. User field set in the service file), a local     attacker who is able to write to the PIDFile of the     mentioned service may use this flaw to trick systemd     into killing other services and/or privileged     processes. Versions before v237 are     vulnerable.(CVE-2018-16888)

  - A vulnerability in unit_deserialize of systemd allows     an attacker to supply arbitrary state across systemd     re-execution via NotifyAccess. This can be used to     improperly influence systemd execution and possibly     lead to root privilege escalation. Affected releases     are systemd versions up to and including     239.(CVE-2018-15686)

  - An out of bounds read was discovered in     systemd-journald in the way it parses log messages that     terminate with a colon ':'. A local attacker can use     this flaw to disclose process memory data. Versions     from v221 to v239 are vulnerable.(CVE-2018-16866)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has systemd packages installed that are affected by multiple vulnerabilities:

  - A vulnerability in unit_deserialize of systemd allows an     attacker to supply arbitrary state across systemd re-     execution via NotifyAccess. This can be used to     improperly influence systemd execution and possibly lead     to root privilege escalation. Affected releases are     systemd versions up to and including 239.
    (CVE-2018-15686)

  - It was discovered systemd does not correctly check the     content of PIDFile files before using it to kill     processes. When a service is run from an unprivileged     user (e.g. User field set in the service file), a local     attacker who is able to write to the PIDFile of the     mentioned service may use this flaw to trick systemd     into killing other services and/or privileged processes.
    Versions before v237 are vulnerable. (CVE-2018-16888)

  - An out of bounds read was discovered in systemd-journald     in the way it parses log messages that terminate with a     colon ':'. A local attacker can use this flaw to     disclose process memory data. Versions from v221 to v239     are vulnerable. (CVE-2018-16866)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for systemd is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es) :

* systemd: line splitting via fgets() allows for state injection during daemon-reexec (CVE-2018-15686)

* systemd: out-of-bounds read when parsing a crafted syslog message (CVE-2018-16866)

* systemd: kills privileged process if unprivileged PIDFile was tampered (CVE-2018-16888)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Security Fix(es) :

  - systemd: line splitting via fgets() allows for state     injection during daemon-reexec (CVE-2018-15686)

  - systemd: out-of-bounds read when parsing a crafted     syslog message (CVE-2018-16866)

  - systemd: kills privileged process if unprivileged     PIDFile was tampered (CVE-2018-16888)

ID	Name	Product	Family	Severity
180808	Oracle Linux 7 : systemd (ELSA-2019-2091)	Nessus	Oracle Linux Local Security Checks	high
164608	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.2)	Nessus	Misc.	critical
164581	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.10.9)	Nessus	Misc.	critical
164573	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16)	Nessus	Misc.	critical
135613	EulerOS Virtualization 3.0.2.2 : systemd (EulerOS-SA-2020-1451)	Nessus	Huawei Local Security Checks	high
134505	EulerOS Virtualization for ARM 64 3.0.2.0 : systemd (EulerOS-SA-2020-1216)	Nessus	Huawei Local Security Checks	high
133523	Ubuntu 16.04 LTS / 18.04 LTS : systemd vulnerabilities (USN-4269-1)	Nessus	Ubuntu Local Security Checks	high
132460	NewStart CGSL CORE 5.05 / MAIN 5.05 : systemd Multiple Vulnerabilities (NS-SA-2019-0242)	Nessus	NewStart CGSL Local Security Checks	high
132206	EulerOS 2.0 SP3 : systemd (EulerOS-SA-2019-2671)	Nessus	Huawei Local Security Checks	medium
131856	EulerOS 2.0 SP2 : systemd (EulerOS-SA-2019-2364)	Nessus	Huawei Local Security Checks	high
130694	EulerOS 2.0 SP5 : systemd (EulerOS-SA-2019-2232)	Nessus	Huawei Local Security Checks	high
129929	NewStart CGSL CORE 5.04 / MAIN 5.04 : systemd Multiple Vulnerabilities (NS-SA-2019-0196)	Nessus	NewStart CGSL Local Security Checks	high
128350	CentOS 7 : systemd (CESA-2019:2091)	Nessus	CentOS Local Security Checks	high
128265	Scientific Linux Security Update : systemd on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	high
127669	RHEL 7 : systemd (RHSA-2019:2091)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2018-16888

medium

Tenable Plugins

high

critical

critical

critical

high

high

high

high

medium

high

high

high

high

high

high