Description
In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | systemd | 242-7 | — |
| Debian 13 | systemd | 242-7 | — |
| Debian 12 | systemd | 242-7 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | systemd | 237-3ubuntu10.28 | USN-4120-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | systemd +7 | 239-18.el8 | RHSA-2019:3592 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | systemd +7 | 239-18.0.1.el8 | ELSA-2019-3592 |
Advisories 4
- WID-SEC-2026-4026 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
- RHSA-2019:3592 Red Hat Security Advisory: systemd security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- USN-4120-1 systemd vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- ELSA-2019-3592 Moderate: systemd security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 14, 2019
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1746057
- http://www.openwall.com/lists/oss-security/2019/09/03/1
- FEDORA-2019-d5bd5f0aa4 vendor-advisory
- FEDORA-2019-24e1d561e5 vendor-advisory
- FEDORA-2019-8a7dfdf1f3 vendor-advisory
- RHSA-2019:3592 vendor-advisory
- RHSA-2019:3941 vendor-advisory