A memory corruption vulnerability has been found in the journald component of systemd >= v230 and <= v240, in the set_iovec_field() function. Passing several megabytes of command-line arguments to a program that calls syslog() led to an attacker-controlled alloca(), which could be used to override the content of the memory, in the stack-clash fashion.
A memory corruption vulnerability has been found in the journald component of systemd >= v230 and <= v240, in the set_iovec_field() function. Passing several megabytes of command-line arguments to a program that calls syslog() led to an attacker-controlled alloca(), which could be used to override the content of the memory, in the stack-clash fashion.
https://www.qualys.com/2019/01/09/system-down/system-down.txt https://github.com/systemd/systemd/pull/11374 https://github.com/systemd/systemd/pull/11374/commits/084eeb865ca63887098e0945fb4e93c852b91b0f
Vulmon