SUSE update for systemd

Published: 2023-04-05

Risk	Low
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2022-3821 CVE-2022-4415 CVE-2023-26604
CWE-ID	CWE-193 CWE-269
Exploitation vector	Local
Public exploit	N/A
Vulnerable software Subscribe	SUSE Linux Enterprise Server for SAP Applications 12 Operating systems & Components / Operating system SUSE Linux Enterprise Server 12 SP4 LTSS Operating systems & Components / Operating system SUSE Linux Enterprise Server 12 SP4 ESPOS Operating systems & Components / Operating system SUSE Linux Enterprise Server 12 Operating systems & Components / Operating system SUSE Linux Enterprise Server 12 SP2 BCL Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 12 Operating systems & Components / Operating system SUSE OpenStack Cloud Crowbar Operating systems & Components / Operating system SUSE OpenStack Cloud Operating systems & Components / Operating system systemd-bash-completion Operating systems & Components / Operating system package or component systemd-debugsource Operating systems & Components / Operating system package or component udev Operating systems & Components / Operating system package or component libsystemd0-debuginfo Operating systems & Components / Operating system package or component systemd-32bit Operating systems & Components / Operating system package or component libsystemd0-debuginfo-32bit Operating systems & Components / Operating system package or component systemd-devel Operating systems & Components / Operating system package or component systemd-debuginfo Operating systems & Components / Operating system package or component libudev1-32bit Operating systems & Components / Operating system package or component libudev1 Operating systems & Components / Operating system package or component systemd-debuginfo-32bit Operating systems & Components / Operating system package or component systemd-sysvinit Operating systems & Components / Operating system package or component libudev1-debuginfo-32bit Operating systems & Components / Operating system package or component udev-debuginfo Operating systems & Components / Operating system package or component libsystemd0-32bit Operating systems & Components / Operating system package or component libudev1-debuginfo Operating systems & Components / Operating system package or component libudev-devel Operating systems & Components / Operating system package or component systemd Operating systems & Components / Operating system package or component libsystemd0 Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Off-by-one

EUVDB-ID: #VU69807

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3821

CWE-ID: CWE-193 - Off-by-one Error

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an off-by-one error within the format_timespan() function in time-util.c. A local user can trigger an off-by-one error and perform a denial of service (DoS) attack.

Mitigation

Update the affected package systemd to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 12: SP4

SUSE Linux Enterprise Server 12 SP4 LTSS: 12-SP4

SUSE Linux Enterprise Server 12 SP4 ESPOS: 12-SP4

SUSE Linux Enterprise Server 12: SP2 - SP4

SUSE Linux Enterprise Server 12 SP2 BCL: 12-SP2

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP4

SUSE OpenStack Cloud Crowbar: 9

SUSE OpenStack Cloud: 9

systemd-bash-completion: before 228-150.108.2

systemd-debugsource: before 228-150.108.2

udev: before 228-150.108.2

libsystemd0-debuginfo: before 228-150.108.2

systemd-32bit: before 228-150.108.2

libsystemd0-debuginfo-32bit: before 228-150.108.2

systemd-devel: before 228-150.108.2

systemd-debuginfo: before 228-150.108.2

libudev1-32bit: before 228-150.108.2

libudev1: before 228-150.108.2

systemd-debuginfo-32bit: before 228-150.108.2

systemd-sysvinit: before 228-150.108.2

libudev1-debuginfo-32bit: before 228-150.108.2

udev-debuginfo: before 228-150.108.2

libsystemd0-32bit: before 228-150.108.2

libudev1-debuginfo: before 228-150.108.2

libudev-devel: before 228-150.108.2

systemd: before 228-150.108.2

libsystemd0: before 228-150.108.2

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20231776-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper Privilege Management

EUVDB-ID: #VU70461

Risk: Low

CVSSv3.1: 3.3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-4415

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to improper privilege management when handling coredumps in coredump/coredump.c. A local user can gain access to sensitive information.

The vulnerability affects systems with libacl support.

Mitigation

Update the affected package systemd to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 12: SP4

SUSE Linux Enterprise Server 12 SP4 LTSS: 12-SP4

SUSE Linux Enterprise Server 12 SP4 ESPOS: 12-SP4

SUSE Linux Enterprise Server 12: SP2 - SP4

SUSE Linux Enterprise Server 12 SP2 BCL: 12-SP2

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP4

SUSE OpenStack Cloud Crowbar: 9

SUSE OpenStack Cloud: 9

systemd-bash-completion: before 228-150.108.2

systemd-debugsource: before 228-150.108.2

udev: before 228-150.108.2

libsystemd0-debuginfo: before 228-150.108.2

systemd-32bit: before 228-150.108.2

libsystemd0-debuginfo-32bit: before 228-150.108.2

systemd-devel: before 228-150.108.2

systemd-debuginfo: before 228-150.108.2

libudev1-32bit: before 228-150.108.2

libudev1: before 228-150.108.2

systemd-debuginfo-32bit: before 228-150.108.2

systemd-sysvinit: before 228-150.108.2

libudev1-debuginfo-32bit: before 228-150.108.2

udev-debuginfo: before 228-150.108.2

libsystemd0-32bit: before 228-150.108.2

libudev1-debuginfo: before 228-150.108.2

libudev-devel: before 228-150.108.2

systemd: before 228-150.108.2

libsystemd0: before 228-150.108.2

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20231776-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper Privilege Management

EUVDB-ID: #VU74146

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-26604

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper privilege management for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

Mitigation

Update the affected package systemd to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 12: SP4

SUSE Linux Enterprise Server 12 SP4 LTSS: 12-SP4

SUSE Linux Enterprise Server 12 SP4 ESPOS: 12-SP4

SUSE Linux Enterprise Server 12: SP2 - SP4

SUSE Linux Enterprise Server 12 SP2 BCL: 12-SP2

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP4

SUSE OpenStack Cloud Crowbar: 9

SUSE OpenStack Cloud: 9

systemd-bash-completion: before 228-150.108.2

systemd-debugsource: before 228-150.108.2

udev: before 228-150.108.2

libsystemd0-debuginfo: before 228-150.108.2

systemd-32bit: before 228-150.108.2

libsystemd0-debuginfo-32bit: before 228-150.108.2

systemd-devel: before 228-150.108.2

systemd-debuginfo: before 228-150.108.2

libudev1-32bit: before 228-150.108.2

libudev1: before 228-150.108.2

systemd-debuginfo-32bit: before 228-150.108.2

systemd-sysvinit: before 228-150.108.2

libudev1-debuginfo-32bit: before 228-150.108.2

udev-debuginfo: before 228-150.108.2

libsystemd0-32bit: before 228-150.108.2

libudev1-debuginfo: before 228-150.108.2

libudev-devel: before 228-150.108.2

systemd: before 228-150.108.2

libsystemd0: before 228-150.108.2

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20231776-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.