CVE-2020-1712 - log back

CVE-2020-1712 edited at 13 Feb 2020 00:40:47
Type
- Arbitrary code execution
+ Privilege escalation
CVE-2020-1712 edited at 12 Feb 2020 21:40:11
Description
- A heap use-after-free vulnerability was found in systemd before version 245, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
+ A heap use-after-free vulnerability was found in systemd before version 244.2, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
CVE-2020-1712 edited at 12 Feb 2020 19:57:22
Remote
- Remote
+ Local
CVE-2020-1712 edited at 12 Feb 2020 19:55:43
References
https://github.com/systemd/systemd/commit/ea0d0ede03c6f18dbc5036c5e9cccf97e415ccc2
+ https://github.com/systemd/systemd-stable/commit/e2d4cb9843c50eff76e9104fec6b448c0d7c8814
CVE-2020-1712 edited at 07 Feb 2020 07:50:57
Severity
- Unknown
+ High
Remote
- Unknown
+ Remote
Type
- Unknown
+ Arbitrary code execution
Description
+ A heap use-after-free vulnerability was found in systemd before version 245, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
References
+ https://github.com/systemd/systemd/commit/ea0d0ede03c6f18dbc5036c5e9cccf97e415ccc2
Notes
CVE-2020-1712 created at 07 Feb 2020 07:49:41