Description
systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | systemd | 246-2 | — |
| Debian 13 | systemd | 246-2 | — |
| Debian 12 | systemd | 246-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | systemd | No fix yet | — |
| Ubuntu Pro 18.04 LTS | systemd | No fix yet | — |
| Ubuntu Pro 16.04 LTS | systemd | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | systemd | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | systemd +7 | 239-45.el8 | RHSA-2021:1611 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.2 EUS | systemd +7 | 239-31.el8_2.7 | RHSA-2021:3900 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | systemd | 239-45.el8 | RLSA-2021:1611 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | systemd +9 | 219-78.amzn2.0.20 | ALAS2-2022-1854 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | systemd +7 | 239-45.0.1.el8 | ELSA-2021-1611 |
Advisories 8
- SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2025-0227 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- RLSA-2021:1611 Moderate: systemd security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- RHSA-2021:3900 Red Hat Security Advisory: systemd security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2021:1611 Red Hat Security Advisory: systemd security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
- ALAS2-2022-1854 Important: systemd security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 10, 2022
- ELSA-2021-1611 Moderate: systemd security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 25, 2021