SB2021112525 - Anolis OS update for systemd

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021112525

SB2021112525 - Anolis OS update for systemd

Published: November 25, 2021 Updated: March 29, 2025

Security Bulletin ID SB2021112525
Severity
Low
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-3842)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to pam_systemd creates a user session using environmental parameters. A local user can spoof an active session and gain additional PolicyKit privileges.


2) Input validation error (CVE-ID: CVE-2020-13776)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to systemd mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended.


3) Input validation error (CVE-ID: CVE-2017-1000082)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to systemd fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges rather than the user intended.


Remediation

Install update from vendor's website.

References