CVE-2019-3844
HIGHsystemd < 242 - Privilege Escalation via DynamicUser SUID Binary Execution
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2019-3844. PoCs published by Google Security Research.
AI-analyzed exploit summary This exploit demonstrates a vulnerability in systemd's DynamicUser feature, where a service can create a setuid binary outside its mount namespace by receiving a file descriptor via a UNIX domain socket from a collaborating user. The PoC includes two C programs to exploit this behavior, resulting in a setuid binary that retains the service's UID after the service terminates.
Description
It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.
Exploits (1)
This exploit demonstrates a vulnerability in systemd's DynamicUser feature, where a service can create a setuid binary outside its mount namespace by receiving a file descriptor via a UNIX domain socket from a collaborating user. The PoC includes two C programs to exploit this behavior, resulting in a setuid binary that retains the service's UID after the service terminates.
References (6)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H