4.6
CVSSv2

CVE-2020-1712

Published: 31/03/2020 Updated: 07/11/2023
CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 409
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

It exists that systemd incorrectly handled certain PIDFile files. A local attacker could possibly use this issue to trick systemd into killing privileged processes. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-16888)

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

systemd project systemd

redhat enterprise linux 8.0

redhat openshift container platform 4.0

redhat discovery -

redhat migration toolkit 1.0

redhat ceph storage 4.0

debian debian linux 9.0

Vendor Advisories

Debian Bug report logs - #950732 systemd: CVE-2020-1712 Package: src:systemd; Maintainer for src:systemd is Debian systemd Maintainers <pkg-systemd-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 5 Feb 2020 13:21:05 UTC Severity: grave Tags: security, upstream ...
Several security issues were fixed in systemd ...
Synopsis Important: systemd security update Type/Severity Security Advisory: Important Topic An update for systemd is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerabili ...
Synopsis Moderate: Red Hat CodeReady Workspaces 210 release Type/Severity Security Advisory: Moderate Topic Red Hat CodeReady Workspaces 210 has been releasedRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, ...
Synopsis Important: systemd security and bug fix update Type/Severity Security Advisory: Important Topic An update for systemd is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) ...
Synopsis Moderate: OpenShift Container Platform 461 image security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat OpenShift Container Platform 46Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability S ...
A heap use-after-free vulnerability was found in systemd, where asynchronous Polkit queries are performed while handling dbus messages A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages (CVE-2020-1712) ...
A heap use-after-free vulnerability was found in systemd before version 245, where asynchronous Polkit queries are performed while handling dbus messages A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages ...

Github Repositories

CMPT 416 Project (Custom Clang Checker for systemd)

CacheChecker CacheChecker detects cache-based use-after-frees within systemd In this repo, we demonstrate how to create a custom Clang static analyzer checker Setup Before building Clang, make sure that you have plenty of space to build it (eg 60 GB) Clone the LLVM repository: githubcom/llvm/llvm-projectgit How to Build Clang There's two ways to build Clan

Recent Articles

Kaspersky cleans up poisoned watering hole, Google presses pause on cookie crackdown
The Register • Shaun Nichols in San Francisco • 06 Apr 2020

Plus: SystemD has a privilege escalation flaw that needs patching, and more bits and bytes

Roundup Kaspersky has detailed its takedown of a massive so-called watering-hole attack appearing to target certain folks in China, in the top story in The Reg's infosec roundup that looks at issues of the past week beyond our own detailed coverage. The security firm said the operation, designed to target "more than 10 websites related to religion, voluntary programs, charity and several other areas," used sites set up to deliver backdoors primarily crafted from open source tools and GitHub repo...