CVE-2019-15718

MEDIUM

systemd 240 - Unauthenticated D-Bus Access Control Bypass via sd_bus_set_trusted

Title source: llm
STIX 2.1

Description

In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.

References (7)

Core 7
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1746057
Exploit, Mailing List, Third Party Advisory x_refsource_misc
http://www.openwall.com/lists/oss-security/2019/09/03/1
Issue Tracking, Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3592
Issue Tracking, Patch, Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3941

Scores

CVSS v3 4.4
EPSS 0.0010
EPSS Percentile 28.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Details

Status published
Products (29)
fedoraproject/fedora 29
fedoraproject/fedora 30
fedoraproject/fedora 31
redhat/enterprise_linux 8.0
redhat/enterprise_linux_eus 8.1
redhat/enterprise_linux_eus 8.2
redhat/enterprise_linux_eus 8.4
redhat/enterprise_linux_for_ibm_z_systems_8_s390x
redhat/enterprise_linux_for_ibm_z_systems_eus 8.1
redhat/enterprise_linux_for_ibm_z_systems_eus 8.2
... and 19 more
Published Sep 04, 2019
Tracked Since Feb 18, 2026