Описание
systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.
A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this can lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), the flaw causes systemd to assert and freeze, resulting in a Denial of Service (DoS).
Отчет
This vulnerability is evaluated as having Moderate impact because exploitation requires existing local system access with authenticated user privileges, precluding direct remote compromise. In default Red Hat Enterprise Linux environments, unprivileged users can interact with systemd via D-Bus, where sending crafted requests to the control group IPC handler triggers an unhandled assertion or memory corruption in PID 1. Consequently, an attacker already present on the machine can disrupt system availability or potentially escalate privileges without requiring administrative rights.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | NetworkManager | Will not fix | ||
| Red Hat Enterprise Linux 10 | rpm-ostree | Not affected | ||
| Red Hat Enterprise Linux 7 | systemd | Not affected | ||
| Red Hat Enterprise Linux 8 | NetworkManager | Will not fix | ||
| Red Hat Enterprise Linux 8 | systemd | Affected | ||
| Red Hat Enterprise Linux 9 | NetworkManager | Will not fix | ||
| Red Hat OpenShift Container Platform 4 | NetworkManager | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-hypershift-rhel9 | Under investigation | ||
| Red Hat OpenShift Container Platform 4 | systemd | Affected | ||
| Red Hat Enterprise Linux 10 | systemd | Fixed | RHSA-2026:13651 | 05.05.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.8 High
CVSS3
Связанные уязвимости
systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.
systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.
systemd, a system and service manager, (as PID 1) hits an assert and f ...
EPSS
7.8 High
CVSS3