Skip to content
OpenAdvisories
Medium ALAS2-2021-1647 3 CVEs

Moderate: systemd security update (Amazon Linux 2)

Published Jun 16, 2021 · Updated Sep 23, 2025

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3815: A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch_message_real() in journald-server.c does not free the memory allocated by set_iovec_field_free() to store the `_CMDLINE=` entry. A local attacker may use this flaw to make systemd-journald crash. 1666690: CVE-2019-3815 systemd: memory leak in journald-server.c introduced by fix for CVE-2018-16864 CVE-2019-20386: A memory leak was discovered in the systemd-login when a power-switch event is received. A physical attacker may trigger one of these events and leak bytes due to a missing free. 1793979: CVE-2019-20386 systemd: memory leak in button_open() in login/logind-button.c when udev events are received CVE-2018-15686: It was discovered that systemd is vulnerable to a state injection attack when deserializing the state of a service. Properties longer than LINE_MAX are not correctly parsed and an attacker may abuse this flaw in particularly configured services to inject, change, or corrupt the service state. 1639071: CVE-2018-15686 systemd: line splitting via fgets() allows for state injection during daemon-reexec

Fixed packages 11

ReleasePackageFixed in
Amazon Linux · 2 libgudev1 0:219-78.amzn2.0.14
Amazon Linux · 2 libgudev1-devel 0:219-78.amzn2.0.14
Amazon Linux · 2 systemd 0:219-78.amzn2.0.14
Amazon Linux · 2 systemd-debuginfo 0:219-78.amzn2.0.14
Amazon Linux · 2 systemd-devel 0:219-78.amzn2.0.14
Amazon Linux · 2 systemd-journal-gateway 0:219-78.amzn2.0.14
Amazon Linux · 2 systemd-libs 0:219-78.amzn2.0.14
Amazon Linux · 2 systemd-networkd 0:219-78.amzn2.0.14
Amazon Linux · 2 systemd-python 0:219-78.amzn2.0.14
Amazon Linux · 2 systemd-resolved 0:219-78.amzn2.0.14
Amazon Linux · 2 systemd-sysv 0:219-78.amzn2.0.14

Vulnerabilities 3

  • High 7.0
    CVE-2018-15686 Public exploit

    systemd: reexec state injection: fgets() on overlong lines leads to line splitting

    A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected relea…

  • Medium 5.1

    An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigg…

  • Low 3.3

    A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch…

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-15686.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-20386.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-3815.html