Published: 09/04/2019 Updated: 07/11/2023

CVSS v2 Base Score: 4.4 | Impact Score: 6.4 | Exploitability Score: 3.4

CVSS v3 Base Score: 7 | Impact Score: 5.9 | Exploitability Score: 1

VMScore: 445

Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P

In systemd before v242-rc4, it exists that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".

Vulnerable Product	Search on Vulmon	Subscribe to Product
systemd project systemd 242
systemd project systemd
redhat enterprise linux 7.0
fedoraproject fedora 30
debian debian linux 8.0

The systemd PAM module could be used to gain additional PolicyKit privileges ...

Jann Horn discovered that the PAM module in systemd insecurely uses the environment and lacks seat verification permitting spoofing an active session to PolicyKit A remote attacker with SSH access can take advantage of this issue to gain PolicyKit privileges that are normally only granted to clients in an active session on the local console For t ...

It was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any" (CVE-201 ...

As documented at <wwwfreedesktoporg/software/polkit/docs/latest/polkit8html>, for any action, a polkit policy can specify separate levels of required authentication based on whether a client is: - in an active session on a local console - in an inactive session on a local console - or neither This is expressed in the policy u ...

systemd suffers from a lack of seat verification in the PAM module and in turn permits the spoofing of an active session to polkit ...

CWE-863 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3842 https://www.exploit-db.com/exploits/46743/http://packetstormsecurity.com/files/152610/systemd-Seat-Verification-Active-Session-Spoofing.html https://lists.debian.org/debian-lts-announce/2019/04/msg00022.html http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STR36RJE4ZZIORMDXRERVBHMPRNRTHAC/https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E https://usn.ubuntu.com/3938-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/46743

CVE-2019-3842

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect