Systemd Project vulnerabilities, page 3
55 vulnerabilities
Known vulnerabilities in Systemd Project products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
CVE-2019-3844chainguardpy3-systemd+13
EPSS score0.92%
It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.CVE-2019-3843chainguardpy3-systemd+14EPSS score0.94%
It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.CVE-2019-3842chainguardpy3-systemd+11EPSS score1.21%
In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".CVE-2026-40227debiansystemd+3EPSS score0.29%
In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.CVE-2026-40224chainguardlibsystemd+18EPSS score0.12%
In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace.CVE-2026-40228debiansystemd+3EPSS score0.14%
In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set.CVE-2026-40223debiansystemd+3EPSS score0.12%
In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.CVE-2026-40226chainguardpy3-systemd+16EPSS score0.09%
In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.CVE-2026-40225chainguardpy3-systemd+8EPSS score0.21%
In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.CVE-2026-29111debiansystemd+30EPSS score0.17%
systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.CVE-2023-26604chainguardpy3-systemd+34EPSS score1.05%
systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.CVE-2023-31437chainguardsystemd+3EPSS score0.34%
An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."CVE-2023-31439chainguardsystemd+3EPSS score0.35%
An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."CVE-2023-31438chainguardsystemd+3EPSS score0.33%
An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."CVE-2023-7008debiansystemd+36EPSS score0.85%
A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.