Summary
It was discovered that systemd did not properly validate the time and
accuracy values provided to the format_timespan() function. An attacker
could possibly use this issue to cause a buffer overrun, leading to a
denial of service attack. This issue only affected Ubuntu 14.04 ESM, Ubuntu
16.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.
(CVE-2022-3821)
It was discovered that systemd did not properly manage the fs.suid_dumpable
kernel configurations. A local attacker could possibly use this issue to
expose sensitive information. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-4415)
It was discovered that systemd did not properly manage a crash with long
backtrace data. A local attacker could possibly use this issue to cause a
deadlock, leading to a denial of service attack. This issue only affected
Ubuntu 22.10. (CVE-2022-45873)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | systemd | 237-3ubuntu10.57 |
| Ubuntu · 20.04 LTS 20.04:LTS | systemd | 245.4-4ubuntu3.20 |
| Ubuntu · 22.04 LTS 22.04:LTS | systemd | 249.11-0ubuntu3.7 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | systemd | 204-5ubuntu20.31+esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | systemd | 229-4ubuntu21.31+esm3 |
Vulnerabilities 2
-
Medium 5.5
An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could sup…
-
Medium 5.5
A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not…