systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology is to crash a binary calling the same function recursively, and put it in a deeply nested directory to make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16 is set for the systemd/units/systemd-coredump.socket file.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:0954 advisory.

  - A vulnerability was found in systemd. This security flaw can cause a local information leak due to     systemd-coredump not respecting the fs.suid_dumpable kernel setting. (CVE-2022-4415)

  - systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that     has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology     is to crash a binary calling the same function recursively, and put it in a deeply nested directory to     make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16     is set for the systemd/units/systemd-coredump.socket file. (CVE-2022-45873)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-025 advisory.

  - A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service     at boot time when too many nested directories are created in /tmp. (CVE-2021-3997)

  - A vulnerability was found in systemd. This security flaw can cause a local information leak due to     systemd-coredump not respecting the fs.suid_dumpable kernel setting. (CVE-2022-4415)

  - systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that     has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology     is to crash a binary calling the same function recursively, and put it in a deeply nested directory to     make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16     is set for the systemd/units/systemd-coredump.socket file. (CVE-2022-45873)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of systemd installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-45873 advisory.

  - systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that     has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology     is to crash a binary calling the same function recursively, and put it in a deeply nested directory to     make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16     is set for the systemd/units/systemd-coredump.socket file. (CVE-2022-45873)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS / 22.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5928-1 advisory.

  - An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An     attacker could supply specific values for time and accuracy that leads to buffer overrun in     format_timespan(), leading to a Denial of Service. (CVE-2022-3821)

  - A vulnerability was found in systemd. This security flaw can cause a local information leak due to     systemd-coredump not respecting the fs.suid_dumpable kernel setting. (CVE-2022-4415)

  - systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that     has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology     is to crash a binary calling the same function recursively, and put it in a deeply nested directory to     make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16     is set for the systemd/units/systemd-coredump.socket file. (CVE-2022-45873)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-0954 advisory.

  - systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that     has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology     is to crash a binary calling the same function recursively, and put it in a deeply nested directory to     make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16     is set for the systemd/units/systemd-coredump.socket file. (CVE-2022-45873)

  - A vulnerability was found in systemd. This security flaw can cause a local information leak due to     systemd-coredump not respecting the fs.suid_dumpable kernel setting. (CVE-2022-4415)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0954 advisory.

  - A vulnerability was found in systemd. This security flaw can cause a local information leak due to     systemd-coredump not respecting the fs.suid_dumpable kernel setting. (CVE-2022-4415)

  - systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that     has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology     is to crash a binary calling the same function recursively, and put it in a deeply nested directory to     make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16     is set for the systemd/units/systemd-coredump.socket file. (CVE-2022-45873)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0954 advisory.

  - A vulnerability was found in systemd. This security flaw can cause a local information leak due to     systemd-coredump not respecting the fs.suid_dumpable kernel setting. (CVE-2022-4415)

  - systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that     has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology     is to crash a binary calling the same function recursively, and put it in a deeply nested directory to     make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16     is set for the systemd/units/systemd-coredump.socket file. (CVE-2022-45873)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-ef4f57b072 advisory.

  - systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that     has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology     is to crash a binary calling the same function recursively, and put it in a deeply nested directory to     make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16     is set for the systemd/units/systemd-coredump.socket file. (CVE-2022-45873)

  - local information leak due to systemd-coredump not respecting fs.suid_dumpable kernel setting [fedora-37]     (CVE-2022-4415)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
173982	Rocky Linux 9 : systemd (RLSA-2023:0954)	Nessus	Rocky Linux Local Security Checks	medium
173143	Amazon Linux 2023 : systemd, systemd-container, systemd-devel (ALAS2023-2023-025)	Nessus	Amazon Linux Local Security Checks	medium
172763	CBL Mariner 2.0 Security Update: systemd (CVE-2022-45873)	Nessus	MarinerOS Local Security Checks	medium
172227	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : systemd vulnerabilities (USN-5928-1)	Nessus	Ubuntu Local Security Checks	medium
172037	Oracle Linux 9 : systemd (ELSA-2023-0954)	Nessus	Oracle Linux Local Security Checks	medium
172002	AlmaLinux 9 : systemd (ALSA-2023:0954)	Nessus	Alma Linux Local Security Checks	medium
171981	RHEL 9 : systemd (RHSA-2023:0954)	Nessus	Red Hat Local Security Checks	medium
169431	Fedora 36 : systemd (2022-ef4f57b072)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2022-45873

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium