CVE-2019-6454: canonical ubuntu_linux Out-of-bounds Write

Modified

AliasesSUSE-SU-2019:0424-1SUSE-SU-2019:0425-1SUSE-SU-2019:0425-2+14 more

Published 17-03-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-6454 is a medium (CVSS 5.5) Out-of-bounds Write vulnerability in canonical ubuntu_linux. EPSS estimates a 2.04% chance of exploitation in the next 30 days, higher than 81.1% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.5/10

010

Medium · v3.1 (NVD)

EPSS score

2.04%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 5 · Related 4

OPENSUSE-SU-2024:11420-1 RHSA-2019:0457 SUSE-SU-2019:1265-1 SUSE-SU-2019:1364-1 SUSE-SU-2019:1364-2

Timeline

17-03-2019
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).

CVSS metrics

6 scores · 4 sources · 3 versions

v3.15.5v3.07.0v2.04.9

EPSS trend

Probability

2.04%

Chance of exploitation in the next 30 days

Percentile

81%

Versus all other CVEs

30-day change

No change 0.00 pp

From 2.04% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat39 products

enterprise_linux8.0
enterprise_linux_compute_node_eus7.5
enterprise_linux_desktop7.0
enterprise_linux_eus7.4 | 7.5 | 8.1 | 8.2 | 8.4
enterprise_linux_for_ibm_z_systems_eus7.4 | 7.5 | 8.1 | 8.2 | 8.4

enterprise_linux_for_power_big_endian_eus7.4
enterprise_linux_for_power_little_endian8.0
enterprise_linux_for_power_little_endian_eus7.4 | 7.5 | 8.1 | 8.2 | 8.4
enterprise_linux_server7.0
enterprise_linux_server_aus7.3 | 7.4 | 7.6 | 8.2 | 8.4
enterprise_linux_server_eus7.6
enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions7.3 | 7.4 | 8.0 | 8.1 | 8.2
enterprise_linux_server_tus7.3 | 7.4 | 7.6 | 8.2 | 8.4
enterprise_linux_server_update_services_for_sap_solutions7.3 | 7.4 | 8.0 | 8.1 | 8.2
enterprise_linux_workstation7.0
libgudev1< 0:219-62.el7_6.5 | < 0:219-57.el7_5.6 | < 0:219-42.el7_4.16 | < 0:219-30.el7_3.14
libgudev1-devel< 0:219-62.el7_6.5 | < 0:219-57.el7_5.6 | < 0:219-42.el7_4.16 | < 0:219-30.el7_3.14
rhvm-appliance< 2:4.2-20190224.0.el7
systemd< 0:219-62.el7_6.5 | < 0:239-13.el8_0.3 | < 0:219-57.el7_5.6 | < 0:219-42.el7_4.16 | < 0:219-30.el7_3.14
systemd-container< 0:239-13.el8_0.3
systemd-container-debuginfo< 0:239-13.el8_0.3
systemd-debuginfo< 0:219-62.el7_6.5 | < 0:239-13.el8_0.3 | < 0:219-57.el7_5.6 | < 0:219-42.el7_4.16 | < 0:219-30.el7_3.14
systemd-debugsource< 0:239-13.el8_0.3
systemd-devel< 0:219-62.el7_6.5 | < 0:239-13.el8_0.3 | < 0:219-57.el7_5.6 | < 0:219-42.el7_4.16 | < 0:219-30.el7_3.14
systemd-journal-gateway< 0:219-62.el7_6.5 | < 0:219-57.el7_5.6 | < 0:219-42.el7_4.16 | < 0:219-30.el7_3.14
systemd-journal-remote< 0:239-13.el8_0.3
systemd-journal-remote-debuginfo< 0:239-13.el8_0.3
systemd-libs< 0:219-62.el7_6.5 | < 0:239-13.el8_0.3 | < 0:219-57.el7_5.6 | < 0:219-42.el7_4.16 | < 0:219-30.el7_3.14
systemd-libs-debuginfo< 0:239-13.el8_0.3
systemd-networkd< 0:219-62.el7_6.5 | < 0:219-57.el7_5.6 | < 0:219-42.el7_4.16 | < 0:219-30.el7_3.14
systemd-pam< 0:239-13.el8_0.3
systemd-pam-debuginfo< 0:239-13.el8_0.3
systemd-python< 0:219-62.el7_6.5 | < 0:219-57.el7_5.6 | < 0:219-42.el7_4.16 | < 0:219-30.el7_3.14
systemd-resolved< 0:219-62.el7_6.5 | < 0:219-57.el7_5.6 | < 0:219-42.el7_4.16 | < 0:219-30.el7_3.14
systemd-sysv< 0:219-62.el7_6.5 | < 0:219-57.el7_5.6 | < 0:219-42.el7_4.16 | < 0:219-30.el7_3.14
systemd-tests< 0:239-13.el8_0.3
systemd-tests-debuginfo< 0:239-13.el8_0.3
systemd-udev< 0:239-13.el8_0.3
systemd-udev-debuginfo< 0:239-13.el8_0.3

Show all 39

Suse17 products

systemd&distro=SUSE Enterprise Storage 4< 228-150.63.1
systemd&distro=SUSE Linux Enterprise Desktop 12 SP3< 228-150.63.1
systemd&distro=SUSE Linux Enterprise Desktop 12 SP4< 228-150.63.1
systemd&distro=SUSE Linux Enterprise Module for Basesystem 15< 234-24.25.1
systemd&distro=SUSE Linux Enterprise Server 12 SP1-LTSS< 210-116.22.1

Show all 17

Opensuse3 products

leapEOL15.0
systemd-mini&distro=openSUSE Leap 15.0< 234-lp150.20.15.1
systemd&distro=openSUSE Leap 15.0< 234-lp150.20.15.1

Debian2 products

systemd< 240-6 | < 232-25+deb9u9 | < 215-17+deb8u10
debian_linuxEOL8.0 | 9.0

Canonical1 product

ubuntu_linuxEOL16.04 | 18.04 | 18.10

Fedoraproject1 product

fedoraEOL29

Mcafee1 product

web_gateway< 7.7.2.21 | ≥ 7.8.0, < 7.8.2.8 | ≥ 8.0.0, < 8.1.1

Netapp1 product

active_iq_performance_analytics_servicesna

Systemd_project1 product

systemd239

Ubuntu1 product

systemd< 229-4ubuntu21.16 | < 237-3ubuntu10.13

10 vendors · 67 products

References

60 links

lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
www.openwall.com/lists/oss-security/2019/02/18/3Mailing ListX Refsource MLISTPatchThird Party Advisory
www.securityfocus.com/bid/107081VDB EntryX Refsource BIDThird Party Advisory
usn.ubuntu.com/3891-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
access.redhat.com/errata/RHSA-2019:0368Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
github.com/systemd/systemd/commits/master/src/libsystemd/sd-bus/bus-objects.cX Refsource MISCPatchThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-02/msg00070.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
www.openwall.com/lists/oss-security/2019/02/19/1Mailing ListX Refsource MLISTThird Party Advisory
lists.debian.org/debian-lts-announce/2019/02/msg00031.htmlMailing ListX Refsource MLISTThird Party Advisory
www.debian.org/security/2019/dsa-4393Vendor AdvisoryX Refsource DEBIANThird Party Advisory

Show all 60 references

security.netapp.com/advisory/ntap-20190327-0004/X Refsource CONFIRMThird Party Advisory
kc.mcafee.com/corporate/index?page=content&id=SB10278X Refsource CONFIRMPatchThird Party Advisory
access.redhat.com/errata/RHSA-2019:0990Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
access.redhat.com/errata/RHSA-2019:1322Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
access.redhat.com/errata/RHSA-2019:1502Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
access.redhat.com/errata/RHSA-2019:2805Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
www.openwall.com/lists/oss-security/2021/07/20/2Mailing ListX Refsource MLISTExploitThird Party Advisory
www.suse.com/support/update/announcement/2019/suse-su-20190424-1/Advisory
bugzilla.suse.com/1125352REPORT
www.suse.com/security/cve/CVE-2019-6454WEB
www.suse.com/support/update/announcement/2019/suse-su-20190425-1/Advisory
www.suse.com/support/update/announcement/2019/suse-su-20190425-2/Advisory
www.suse.com/support/update/announcement/2019/suse-su-20190426-1/Advisory
bugzilla.suse.com/1117025REPORT
bugzilla.suse.com/1121563REPORT
bugzilla.suse.com/1122000REPORT
bugzilla.suse.com/1123333REPORT
bugzilla.suse.com/1123727REPORT
bugzilla.suse.com/1123892REPORT
bugzilla.suse.com/1124153REPORT
www.suse.com/support/update/announcement/2019/suse-su-20190428-1/Advisory
bugzilla.suse.com/1111498REPORT
bugzilla.suse.com/1117382REPORT
bugzilla.suse.com/1120658REPORT
bugzilla.suse.com/1122344REPORT
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1667032REPORT
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0368.jsonAdvisory
access.redhat.com/security/cve/CVE-2019-6454REPORT
www.cve.org/CVERecord?id=CVE-2019-6454AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2019-6454AdvisoryOval
access.redhat.com/errata/RHSA-2019:0461Advisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0461.jsonAdvisory
bugzilla.redhat.com/show_bug.cgi?id=1693578REPORT
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0990.jsonAdvisory
bugzilla.redhat.com/show_bug.cgi?id=1711872REPORT
bugzilla.redhat.com/show_bug.cgi?id=1711875REPORT
bugzilla.redhat.com/show_bug.cgi?id=1711876REPORT
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1322.jsonAdvisory
bugzilla.redhat.com/show_bug.cgi?id=1709184REPORT
bugzilla.redhat.com/show_bug.cgi?id=1709185REPORT
bugzilla.redhat.com/show_bug.cgi?id=1709187REPORT
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1502.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2805.jsonAdvisory
ubuntu.com/security/CVE-2019-6454REPORT
ubuntu.com/security/notices/USN-3891-1Advisory
security-tracker.debian.org/tracker/CVE-2019-6454Advisory
lists.opensuse.org/archives/…Advisory