[ GLSA 202003-20 ] systemd

[GLSA]

Gentoo Linux Security Advisory

Title: systemd: Heap use-after-free (GLSA 202003-20)
Severity: high
Exploitable: local
Date: 2020-03-15
Bug(s): #708806
ID: 202003-20

Synopsis

A heap use-after-free flaw in systemd at worst might allow an
attacker to execute arbitrary code.


Background

A system and service manager.

Affected Packages

Package: sys-apps/systemd
Vulnerable: < 244.3
Unaffected: >= 244.3
Architectures: All supported architectures


Description

It was found that systemd incorrectly handled certain Polkit queries.

Impact

A local unprivileged user, by sending a specially crafted Polkit query,
could possibly execute arbitrary code with the privileges of the process,
escalate privileges or cause a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All systemd users should upgrade to the latest version: