Description
A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | systemd-resolved | systemd 240 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | systemd | 240-1 | — |
| Debian 13 | systemd | 240-1 | — |
| Debian 12 | systemd | 240-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | systemd | 237-3ubuntu10.54 | USN-5583-2, USN-5583-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | systemd +7 | 239-58.el8_6.4 | RHSA-2022:6206 |
| RHEL 7 | systemd +9 | 219-78.el7_9.7 | RHSA-2022:6160 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Hypervisor 4 | redhat-virtualization-host +1 | 4.5.2-202209140405_8.6 | RHSA-2022:6551 |
| RHEL 8.4 EUS | systemd +7 | 239-45.el8_4.12 | RHSA-2022:6161 |
| RHEL 8.2 EUS | systemd +7 | 239-31.el8_2.9 | RHSA-2022:6162 |
| RHEL 8.1 E4S | systemd +7 | 239-18.el8_1.11 | RHSA-2022:6163 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | systemd +7 | 239-58.el8_6.4 | ALSA-2022:6206 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | systemd | 239-58.el8_6.4 | RLSA-2022:6206 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | systemd +9 | 219-78.amzn2.0.20 | ALAS2-2022-1854 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | systemd +7 | 239-58.0.1.el8_6.4 | ELSA-2022-6206 |
| Oracle Linux 7 | systemd +9 | 219-78.0.9.el7_9.7 | ELSA-2022-6160 |
Advisories 18
- ALSA-2022:6206 Important: systemd security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:6551 Red Hat Security Advisory: Red Hat Virtualization security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2022:6160 Red Hat Security Advisory: systemd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-5583-2 systemd regression Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-5583-1 systemd vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- RLSA-2022:6206 Important: systemd security update Rocky Linux Security Advisories · Feb 4, 2026
- RHSA-2022:6163 Red Hat Security Advisory: systemd security update Red Hat Security Advisories (RHSA) · Dec 27, 2025
- RHSA-2022:6162 Red Hat Security Advisory: systemd security update Red Hat Security Advisories (RHSA) · Dec 27, 2025
- RHSA-2022:6161 Red Hat Security Advisory: systemd security update Red Hat Security Advisories (RHSA) · Dec 27, 2025
- RHSA-2022:6206 Red Hat Security Advisory: systemd security update Red Hat Security Advisories (RHSA) · Dec 27, 2025
- ICSA-25-105-08 ABB M2M Gateway CISA ICS & IT advisories · Apr 7, 2025
- 2NGA002579 ABB Arctic communication solution ARM600 Vulnerabilities ABB PSIRT · Apr 7, 2025
- WID-SEC-2023-0137 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 21, 2024
- WID-SEC-2024-1591 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
- WID-SEC-2022-1177 systemd: Schwachstelle ermöglicht nicht spezifizierten Angriff BSI CERT-Bund (WID) · May 30, 2023
- ALAS2-2022-1854 Important: systemd security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 10, 2022
- ELSA-2022-6206 Important: systemd security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 29, 2022
- ELSA-2022-6160 Important: systemd security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 25, 2022