CVE-2019-3842
published 2019-04-09CVE-2019-3842: In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible…
PriorityP338high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EXPLOIT
EPSS
1.22%
65.2th percentile
In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | systemd | < systemd 241-3 (bookworm) | systemd 241-3 (bookworm) |
| fedoraproject | fedora | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cm1_systemd_239-34_on_cbl_mariner_1.0 | — | — |
| redhat | enterprise_linux | — | — |
| systemd_project | systemd | <= 241 | — |
| systemd_project | systemd | — | — |
| systemd_project | systemd | >= 0 < 241-3 | 241-3 |
| systemd_project | systemd | >= 0 < 241-3 | 241-3 |
| systemd_project | systemd | >= 0 < 241-3 | 241-3 |
| systemd_project | systemd | >= 0 < 241-3 | 241-3 |
| the_systemd_project | systemd | — | — |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv3.04.5MEDIUMCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
nvdv2.04.4MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P
osv7.0HIGH
vendor_debian7.0HIGH
vendor_msrc7.0HIGH
vendor_redhat7.0HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c23j-qp89-q76c: In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable
ghsa_unreviewed·2022-05-13
CVE-2019-3842 [HIGH] CWE-863 GHSA-c23j-qp89-q76c: In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable
In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".
OSV
CVE-2019-3842: In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable
osv·2019-04-09·CVSS 7.0
CVE-2019-3842 [HIGH] CVE-2019-3842: In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable
In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".
Microsoft
In systemd before v242-rc4 it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker in some particular configura
vendor_msrc·2019-04-09·CVSS 7.0
CVE-2019-3842 [HIGH] CWE-863 In systemd before v242-rc4 it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker in some particular configura
In systemd before v242-rc4 it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker in some particular configurations to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work
Ubuntu
systemd vulnerability
vendor_ubuntu·2019-04-08
CVE-2019-3842 systemd vulnerability
Title: systemd vulnerability
Summary: The systemd PAM module could be used to gain additional PolicyKit
privileges.
Jann Horn discovered that pam_systemd created logind sessions using some
parameters from the environment. A local attacker could exploit this in
order to spoof the active session and gain additional PolicyKit
privileges.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
systemd: Spoofing of XDG_SEAT allows for actions to be checked against "allow_active" instead of "allow_any"
vendor_redhat·2019-04-08·CVSS 7.0
CVE-2019-3842 [HIGH] CWE-863 systemd: Spoofing of XDG_SEAT allows for actions to be checked against "allow_active" instead of "allow_any"
systemd: Spoofing of XDG_SEAT allows for actions to be checked against "allow_active" instead of "allow_any"
In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".
It was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element ra
Debian
CVE-2019-3842: systemd - In systemd before v242-rc4, it was discovered that pam_systemd does not properly...
vendor_debian·2019·CVSS 7.0
CVE-2019-3842 [HIGH] CVE-2019-3842: systemd - In systemd before v242-rc4, it was discovered that pam_systemd does not properly...
In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".
Scope: local
bookworm: resolved (fixed in 241-3)
bullseye: resolved (fixed in 241-3)
forky: resolved (fixed in 241-3)
sid: resolved (fixed in 241-3)
trixie: resolved (fixed in 241-3)
No detection rules found.
Bugzilla
CVE-2019-3842 systemd: Spoofing of XDG_SEAT allows for actions to be checked against "allow_active" instead of "allow_any" [fedora-all]
bugzilla·2019-04-09·CVSS 7.0
CVE-2019-3842 [HIGH] CVE-2019-3842 systemd: Spoofing of XDG_SEAT allows for actions to be checked against "allow_active" instead of "allow_any" [fedora-all]
CVE-2019-3842 systemd: Spoofing of XDG_SEAT allows for actions to be checked against "allow_active" instead of "allow_any" [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit mess
Bugzilla
CVE-2019-3842 systemd: Spoofing of XDG_SEAT allows for actions to be checked against "allow_active" instead of "allow_any"
bugzilla·2019-01-23·CVSS 7.0
CVE-2019-3842 [HIGH] CVE-2019-3842 systemd: Spoofing of XDG_SEAT allows for actions to be checked against "allow_active" instead of "allow_any"
CVE-2019-3842 systemd: Spoofing of XDG_SEAT allows for actions to be checked against "allow_active" instead of "allow_any"
systemd has a vulnerability in the PAM module, pam_systemd, that allows for spoofing of the XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any". Users with local access to machines with an active tty sessions can exploit this to elevate their privileges.
Discussion:
pam_systemd uses getenv() to retrieve XDG_SEAT value, however when pam_systemd is used by a SUID binary this allows a unprivileged user, in some circumstances, to provide a fake XDG_SEAT value, with the consequences mentioned in comment 0.
---
For the attack to be successful, a new session must be created
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.htmlhttp://packetstormsecurity.com/files/152610/systemd-Seat-Verification-Active-Session-Spoofing.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3842https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2019/04/msg00022.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STR36RJE4ZZIORMDXRERVBHMPRNRTHAC/https://www.exploit-db.com/exploits/46743/http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.htmlhttp://packetstormsecurity.com/files/152610/systemd-Seat-Verification-Active-Session-Spoofing.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3842https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2019/04/msg00022.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STR36RJE4ZZIORMDXRERVBHMPRNRTHAC/https://www.exploit-db.com/exploits/46743/
2019-04-09
Published