CVE-2018-16864

CWE-770 — Allocation without LimitsCWE-401 — Memory Leak13 documents9 sources
Severity
7.8HIGH
EPSS
0.1%
top 65.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
12
Systemd Project SystemdTHE Systemd Project SystemdCanonical Ubuntu Linux+9 more
Timeline
PublishedJan 11
Latest updateMay 13

Description

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages9 packages

▶Debiansystemd< 240-4+3
▶Ubuntusystemd< 229-4ubuntu21.15+1
▶CVEListV5the_systemd_project/systemdthrough v240, v219-62.2 and newer+1

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 16.04, 18.04, 18.10, Enterprise Linux 7.3, 7.6, 7.4

Patches

Patch: bugzilla.redhat.com ↗Patch: www.oracle.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-h53q-m6g5-wfq9: An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a↗2022-05-13
▶
OSV
systemd vulnerabilities↗2019-01-11
▶
OSV
CVE-2018-16864: An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a↗2019-01-11
▶
CVEList
CVE-2018-16864: An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a↗2019-01-11
▶

📋Vendor Advisories

5
Red Hat
systemd: memory leak in journald-server.c introduced by fix for CVE-2018-16864↗2019-01-14
▶
Ubuntu
systemd vulnerabilities↗2019-01-11
▶
Red Hat
systemd: stack overflow when calling syslog from a command with long cmdline↗2019-01-09
▶
Microsoft
An allocation of memory without limits that could result in the stack clashing with another memory region was discovered in systemd-journald when a program with long command line arguments calls syslo↗2019-01-08
▶
Debian
CVE-2018-16864: systemd - An allocation of memory without limits, that could result in the stack clashing ...↗2018
▶

💬Community

3
Bugzilla
CVE-2019-3815 systemd: memory leak in journald-server.c introduced by fix for CVE-2018-16864↗2019-01-16
▶
Bugzilla
CVE-2018-16864 systemd: stack overflow when calling syslog from a command with long cmdline [fedora-all]↗2019-01-10
▶
Bugzilla
CVE-2018-16864 systemd: stack overflow when calling syslog from a command with long cmdline↗2018-11-27
▶