CVE-2020-1712: A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while hand

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• debian debian linux9.0
• redhat ceph storage4.0
• redhat discoveryall versions
• redhat enterprise linux8.0
• redhat migration toolkit1.0
• redhat openshift container platform4.0
• systemd project systemdup to 244 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• [UNKNOWN] systemd

  • before v245-rc1affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2017-9445In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small.
  46Plan
• CVE-2018-21029systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS.
  40Plan
• CVE-2015-7510Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
  40Plan

Published before and after this one in the same product

• ← EarlierCVE-2019-20386Jan 21, 2020 · An issue was discovered in button_open in login/logind-button.c in systemd before 243.
  9Monitor
• ← EarlierCVE-2012-1101Mar 11, 2020 · systemd 37-1 does not properly handle non-existent services, which causes a denial of service (failure of login procedure).
  22Monitor
• Later →CVE-2020-13776Jun 3, 2020 · systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by
  26Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.