תיאור (מקור, אנגלית)
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
מוצרים מושפעים
systemd_project: systemd; redhat: ceph storage; redhat: discovery; redhat: migration toolkit; redhat: openshift container platform; redhat: enterprise linux; debian: debian linux
קישורים10
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1712 Issue TrackingPatchThird Party Advisory
- github.com/systemd/systemd/commit/1068447e6954dc6ce52f099ed174… PatchThird Party Advisory
- github.com/systemd/systemd/commit/637486261528e8aa3da9f26a4487… PatchThird Party Advisory
- github.com/systemd/systemd/commit/bc130b6858327b382b07b3985cf4… PatchThird Party Advisory
- github.com/systemd/systemd/commit/ea0d0ede03c6f18dbc5036c5e9cc… PatchThird Party Advisory
- www.openwall.com/lists/oss-security/2020/02/05/1 Mailing ListPatchThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1712 Issue TrackingPatchThird Party Advisory
- github.com/systemd/systemd/commit/1068447e6954dc6ce52f099ed174… PatchThird Party Advisory
- github.com/systemd/systemd/commit/637486261528e8aa3da9f26a4487… PatchThird Party Advisory
- github.com/systemd/systemd/commit/bc130b6858327b382b07b3985cf4… PatchThird Party Advisory
מדדים
- CVSS 3.1
-
7.8
HIGH
מקור הציון: NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — סבירות ניצול
- 0% אחוזון 40 · נכון ל-2 בנובמבר 2026
- CWE
- CWE-416