CVE-2019-3843CWE-266

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service…

Medium · published April 26, 2019

CVSS v3.0
4.5
EPSS
1%
Percentile
60.6
In the wild
Unconfirmed
What it is

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.

The record
Technical detail
CVSS v3.0
4.5 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00940 · 60.6th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2019-04-26T20:27Z
EPSS history
Timeline
  • 26 APR 20:27Z
    It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service…
    cvelistv5