Описание
ELSA-2026-18153: systemd security update (MODERATE)
[257-23.0.1.el10_2.2]
- Fix detection of Oracle Virtualization or BM envs [Orabug: 37531877]
- Avoid udevadm warnings when using udev valid configs [Orabug: 37503197]
- allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469]
- set 'RemoveIPC=no' in logind.conf as default [Orabug: 22224874]
- Fix missing netdev for iscsi entry in fstab [Orabug: 25897792]
- udev rules: fix memory hot add and remove [Orabug: 31310273]
- Disable unprivileged BPF by default [Orabug: 32870980]
- Remove upstream references [Orabug: 33995357]
- Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407]
- Removed unneeded patches from the systemd.spec
- 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490]
- 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490]
- 1006-orabug34467234-shutdown-get-only-active-md-arrays.patch [Orabug: 34467234]
- 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110]
- 1008-path-drop-IN_ATTRIB-from-parent-directory-watches.patch [Orabug: 36780432]
[257-23.2]
- nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163873)
- nspawn: normalize pivot_root paths (RHEL-163873)
- udev: check for invalid chars in various fields received from the kernel (RHEL-163879)
- udev: ensure there is space for trailing NUL before calling sprintf (RHEL-163879)
- udev: ensure tag parsing stays within bounds (RHEL-163879)
- udev: fix review mixup (RHEL-163879)
- udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163879)
- udev-builtin-net-id: print cescaped bad attributes (RHEL-163879)
[257-23.1]
- ci: re-enable bpf-framework option for build and unit test jobs (RHEL-152080)
- ci: add bpftool workaround to codeql job too (RHEL-152080)
- ci: fix workaround about bpftool for codeql (RHEL-152080)
- ci: add bpftool workaround to coverity too (RHEL-152080)
- path-util: add flavour of path_startswith() that leaves a leading slash in place (RHEL-152080)
- cgroup: port some code over to path_startswith_full() (RHEL-152080)
- path-util: invert PATH_STARTSWITH_ACCEPT_DOT_DOT flag (RHEL-152080)
- sd-json: fix off-by-one issue when updating parent for array elements (RHEL-152080)
- core/cgroup: avoid one unnecessary strjoina() (RHEL-152080)
- core: validate input cgroup path more prudently (RHEL-152080)
Обновленные пакеты
Oracle Linux 10
Oracle Linux aarch64
systemd-boot-unsigned
257-23.0.1.el10_2.2
systemd-devel
257-23.0.1.el10_2.2
systemd-journal-remote
257-23.0.1.el10_2.2
systemd-ukify
257-23.0.1.el10_2.2
systemd
257-23.0.1.el10_2.2
systemd-container
257-23.0.1.el10_2.2
systemd-libs
257-23.0.1.el10_2.2
systemd-oomd
257-23.0.1.el10_2.2
systemd-pam
257-23.0.1.el10_2.2
systemd-resolved
257-23.0.1.el10_2.2
systemd-rpm-macros
257-23.0.1.el10_2.2
systemd-udev
257-23.0.1.el10_2.2
Oracle Linux x86_64
systemd-boot-unsigned
257-23.0.1.el10_2.2
systemd-devel
257-23.0.1.el10_2.2
systemd-journal-remote
257-23.0.1.el10_2.2
systemd-ukify
257-23.0.1.el10_2.2
systemd
257-23.0.1.el10_2.2
systemd-container
257-23.0.1.el10_2.2
systemd-libs
257-23.0.1.el10_2.2
systemd-oomd
257-23.0.1.el10_2.2
systemd-pam
257-23.0.1.el10_2.2
systemd-resolved
257-23.0.1.el10_2.2
systemd-rpm-macros
257-23.0.1.el10_2.2
systemd-udev
257-23.0.1.el10_2.2
Связанные CVE
Связанные уязвимости
A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.
A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.
A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.
Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump
A vulnerability was found in systemd-coredump. This flaw allows an att ...