CVE-2018-16865 An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local...
HighCVSS 7.8
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/systemd(Debian:12) | < 240-4 | 240-4 |
| debian/systemd(Debian:13) | < 240-4 | 240-4 |
| debian/systemd(Debian:14) | < 240-4 | 240-4 |
| systemd project systemd | <= 240 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.10 | No fix listed |
| oracle communications session border controller | = 8.0.0 | No fix listed |
| oracle communications session border controller | = 8.1.0 | No fix listed |
| oracle communications session border controller | = 8.2.0 | No fix listed |
| oracle enterprise communications broker | = 3.0.0 | No fix listed |
| oracle enterprise communications broker | = 3.1.0 | No fix listed |
| The systemd Project systemd | = through v240 | No fix listed |
References
- Debian Security Tracker CVE-2018-16865 vendor-advisory
- packetstormsecurity.com third-party-advisory vdb-entry
- 20190513 Re: System Down: A systemd-journald exploit mailing-list third-party-advisory
- [oss-security] 20190510 Re: System Down: A systemd-journald exploit mailing-list third-party-advisory
- [oss-security] 20210720 CVE-2021-33910: Denial of service (stack exhaustion) in systemd (PID 1) mailing-list third-party-advisory
- 106525 third-party-advisory vdb-entry
- RHBA-2019:0327 third-party-advisory vendor-advisory
- RHSA-2019:0049 third-party-advisory vendor-advisory
- RHSA-2019:0204 third-party-advisory vendor-advisory
- RHSA-2019:0271 third-party-advisory vendor-advisory
- RHSA-2019:0342 third-party-advisory vendor-advisory
- RHSA-2019:0361 third-party-advisory vendor-advisory
- RHSA-2019:2402 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking patch
- [debian-lts-announce] 20190123 [SECURITY] [DLA 1639-1] systemd security update mailing-list third-party-advisory
- 20190513 Re: System Down: A systemd-journald exploit mailing-list third-party-advisory
- GLSA-201903-07 third-party-advisory vendor-advisory
- security.netapp.com third-party-advisory
- USN-3855-1 third-party-advisory vendor-advisory
- DSA-4367 third-party-advisory vendor-advisory
- www.oracle.com patch third-party-advisory
- www.qualys.com exploit third-party-advisory
- bugs.debian.org issue-tracking