CVE-2018-1049 In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint a...
MediumCVSS 5.9
EPSS 7.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/systemd(Debian:12) | < 234-1 | 234-1 |
| debian/systemd(Debian:13) | < 234-1 | 234-1 |
| debian/systemd(Debian:14) | < 234-1 | 234-1 |
| systemd project systemd | < 234 | 234 |
| redhat enterprise linux | = 7.0 | No fix listed |
| redhat enterprise linux aus | = 7.4 | No fix listed |
| redhat enterprise linux aus | = 7.6 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.4 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| redhat/systemd | = prior to 234 | No fix listed |
References
- Debian Security Tracker CVE-2018-1049 vendor-advisory
- 1041520 third-party-advisory vdb-entry
- RHSA-2018:0260 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- [debian-lts-announce] 20181119 [SECURITY] [DLA 1580-1] systemd security update mailing-list third-party-advisory
- USN-3558-1 third-party-advisory vendor-advisory