In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted.

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered systemd does not correctly check the     content of PIDFile files before using it to kill     processes. When a service is run from an unprivileged     user (e.g. User field set in the service file), a local     attacker who is able to write to the PIDFile of the     mentioned service may use this flaw to trick systemd     into killing other services and/or privileged     processes. Versions before v237 are     vulnerable.(CVE-2018-16888)

  - In systemd prior to 234 a race condition exists between     .mount and .automount units such that automount     requests from kernel may not be serviced by systemd     resulting in kernel holding the mountpoint and any     processes that try to use said mount will hang. A race     condition like this may lead to denial of service,     until mount points are unmounted.(CVE-2018-1049)

  - A vulnerability in unit_deserialize of systemd allows     an attacker to supply arbitrary state across systemd     re-execution via NotifyAccess. This can be used to     improperly influence systemd execution and possibly     lead to root privilege escalation. Affected releases     are systemd versions up to and including     239.(CVE-2018-15686)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 5.04, has systemd packages installed that are affected by a vulnerability:

  - A race condition was found in systemd. This could result     in automount requests not being serviced and processes     using them could hang, causing denial of service.
    (CVE-2018-1049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the systemd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An allocation of memory without limits, that could     result in the stack clashing with another memory     region, was discovered in systemd-journald when a     program with long command line arguments calls syslog.
    A local attacker may use this flaw to crash     systemd-journald or escalate his privileges. Versions     through v240 are vulnerable.(CVE-2018-16864)

  - An allocation of memory without limits, that could     result in the stack clashing with another memory     region, was discovered in systemd-journald when many     entries are sent to the journal socket. A local     attacker, or a remote one if systemd-journal-remote is     used, may use this flaw to crash systemd-journald or     execute code with journald privileges. Versions through     v240 are vulnerable.(CVE-2018-16865)

  - An issue was discovered in sd-bus in systemd 239.
    bus_process_object() in libsystemd/sd-bus/bus-objects.c     allocates a variable-length stack buffer for     temporarily storing the object path of incoming D-Bus     messages. An unprivileged local user can exploit this     by sending a specially crafted message to PID1, causing     the stack pointer to jump over the stack guard pages     into an unmapped memory region and trigger a denial of     service (systemd PID1 crash and kernel     panic).(CVE-2019-6454)

  - A race condition was found in systemd. This could     result in automount requests not being serviced and     processes using them could hang, causing denial of     service.(CVE-2018-1049)

  - It was discovered that systemd-network does not     correctly keep track of a buffer size when constructing     DHCPv6 packets. This flaw may lead to an integer     underflow that can be used to produce an heap-based     buffer overflow. A malicious host on the same network     segment as the victim's one may advertise itself as a     DHCPv6 server and exploit this flaw to cause a Denial     of Service or potentially gain code execution on the     victim's machine.(CVE-2018-15688)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the systemd package has been released.

systemd was found to suffer from multiple security vulnerabilities ranging from denial of service attacks to possible root privilege escalation.

CVE-2018-1049

A race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted.

CVE-2018-15686

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess.
This can be used to improperly influence systemd execution and possibly lead to root privilege escalation.

CVE-2018-15688

A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd, which is not enabled by default in Debian.

For Debian 8 'Jessie', these problems have been fixed in version 215-17+deb8u8.

We recommend that you upgrade your systemd packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - In systemd prior to 234 a race condition exists between     .mount and .automount units such that automount     requests from kernel may not be serviced by systemd     resulting in kernel holding the mountpoint and any     processes that try to use said mount will hang. A race     condition like this may lead to denial of service,     until mount points are unmounted.(CVE-2018-1049)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Access to automounted volumes can lock up

A race condition was found in systemd. This could result in automount requests not being serviced and processes using them could hang, causing denial of service.(CVE-2018-1049)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3558-1 advisory.

    Karim Hossen & Thomas Imbert and Nelson William Gamazo Sanchez independently discovered that systemd-     resolved incorrectly handled certain DNS responses. A remote attacker could possibly use this issue to     cause systemd to temporarily stop responding, resulting in a denial of service. This issue only affected     Ubuntu 16.04 LTS. (CVE-2017-15908)

    It was discovered that systemd incorrectly handled automounted volumes. A local attacker could possibly     use this issue to cause applications to hang, resulting in a denial of service. (CVE-2018-1049)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-0260 advisory.

    [219-42.0.2.7]
    - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792] (tony.l.lam@oracle.com)
    - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [22224874]
    - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
    - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]

    [219-42.7]
    - automount: ack automount requests even when already mounted (#1535135)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for systemd is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es) :

* A race condition was found in systemd. This could result in automount requests not being serviced and processes using them could hang, causing denial of service. (CVE-2018-1049)

Security Fix(es) :

  - A race condition was found in systemd. This could result     in automount requests not being serviced and processes     using them could hang, causing denial of service.
    (CVE-2018-1049)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:0260 advisory.

    The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and     LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for     starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups.
    In addition, it supports snapshotting and restoring of the system state, maintains mount and automount     points, and implements an elaborate transactional dependency-based service control logic. It can also work     as a drop-in replacement for sysvinit.

    Security Fix(es):

    * A race condition was found in systemd. This could result in automount requests not being serviced and     processes using them could hang, causing denial of service. (CVE-2018-1049)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for systemd fixes several issues.

This security issue was fixed :

  - CVE-2018-1049: Prevent race that can lead to DoS when     using automounts (bsc#1076308).

These non-security issues were fixed :

  - core: don't choke if a unit another unit triggers     vanishes during reload

  - delta: don't ignore PREFIX when the given argument is     PREFIX/SUFFIX

  - delta: extend skip logic to work on full directory paths     (prefix+suffix) (bsc#1070428)

  - delta: check if a prefix needs to be skipped only once

  - delta: skip symlink paths when split-usr is enabled     (#4591)

  - sysctl: use raw file descriptor in sysctl_write (#7753)

  - sd-netlink: don't take possesion of netlink fd from     caller on failure (bsc#1074254)

  - Fix the regexp used to detect broken by-id symlinks in     /etc/crypttab It was missing the following case:
    '/dev/disk/by-id/cr_-xxx'.

  - sysctl: disable buffer while writing to /proc     (bsc#1071558)

  - Use read_line() and LONG_LINE_MAX to read values     configuration files. (bsc#1071558)

  - sysctl: no need to check for eof twice

  - def: add new constant LONG_LINE_MAX

  - fileio: add new helper call read_line() as bounded     getline() replacement

  - service: Don't stop unneeded units needed by restarted     service (#7526) (bsc#1066156)

  - gpt-auto-generator: fix the handling of the value     returned by fstab_has_fstype() in add_swap() (#6280)

  - gpt-auto-generator: disable gpt auto logic for swaps if     at least one is defined in fstab (bsc#897422)

  - fstab-util: introduce fstab_has_fstype() helper

  - fstab-generator: ignore root=/dev/nfs (#3591)

  - fstab-generator: don't process root= if it happens to be     'gpt-auto' (#3452)

  - virt: use XENFEAT_dom0 to detect the hardware domain     (#6442, #6662) (#7581) (bsc#1048510)

  - analyze: replace --no-man with --man=no in the man page     (bsc#1068251)

  - udev: net_setup_link: don't error out when we couldn't     apply link config (#7328)

  - Add missing /etc/systemd/network directory

  - Fix parsing of features in detect_vm_xen_dom0 (#7890)     (bsc#1048510)

  - sd-bus: use -- when passing arguments to ssh (#6706)

  - systemctl: make sure we terminate the bus connection     first, and then close the pager (#3550)

  - sd-bus: bump message queue size (bsc#1075724)

  - tmpfiles: downgrade warning about duplicate line

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for systemd fixes several issues. This security issue was fixed :

  - CVE-2018-1049: Prevent race that can lead to DoS when     using automounts (bsc#1076308).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
131856	EulerOS 2.0 SP2 : systemd (EulerOS-SA-2019-2364)	Nessus	Huawei Local Security Checks	high
127166	NewStart CGSL MAIN 5.04 : systemd Vulnerability (NS-SA-2019-0014)	Nessus	NewStart CGSL Local Security Checks	medium
124915	EulerOS Virtualization for ARM 64 3.0.1.0 : systemd (EulerOS-SA-2019-1412)	Nessus	Huawei Local Security Checks	high
121972	Photon OS 2.0: Systemd PHSA-2018-2.0-0076	Nessus	PhotonOS Local Security Checks	medium
121866	Photon OS 1.0: Systemd PHSA-2018-1.0-0167	Nessus	PhotonOS Local Security Checks	medium
119039	Debian DLA-1580-1 : systemd security update	Nessus	Debian Local Security Checks	high
117552	EulerOS Virtualization 2.5.0 : systemd (EulerOS-SA-2018-1243)	Nessus	Huawei Local Security Checks	medium
109129	Amazon Linux 2 : systemd (ALAS-2018-961)	Nessus	Amazon Linux Local Security Checks	medium
106620	Ubuntu 14.04 LTS / 16.04 LTS : systemd vulnerabilities (USN-3558-1)	Nessus	Ubuntu Local Security Checks	high
106571	Oracle Linux 7 : systemd (ELSA-2018-0260)	Nessus	Oracle Linux Local Security Checks	medium
106566	CentOS 7 : systemd (CESA-2018:0260)	Nessus	CentOS Local Security Checks	medium
106554	Scientific Linux Security Update : systemd on SL7.x x86_64 (20180131)	Nessus	Scientific Linux Local Security Checks	medium
106553	RHEL 7 : systemd (RHSA-2018:0260)	Nessus	Red Hat Local Security Checks	medium
106548	openSUSE Security Update : systemd (openSUSE-2018-117)	Nessus	SuSE Local Security Checks	high
106529	SUSE SLED12 / SLES12 Security Update : systemd (SUSE-SU-2018:0299-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-1049

medium

Tenable Plugins

high

medium

high

medium

medium

high

medium

medium

high

medium

medium

medium

medium

high

high