SB2022022605 - openEuler update for systemd

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2020-13776)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to systemd mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended.

2) Input validation error (CVE-ID: CVE-2017-1000082)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to systemd fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges rather than the user intended.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1538