In the system manager systemd vulnerability (), which potentially allows for the execution of arbitrary code with elevated privileges through sending a specially crafted request over the DBus bus. The issue has been fixed in the testing release (problem-solving patches: , , ). The vulnerability has been addressed in distributions , , (present in RHEL 8, but not affecting RHEL 7), , and , but as of the time of writing, it remains unpatched in and .
The vulnerability is caused by accessing a previously freed memory area (use-after-free) that occurs during asynchronous requests to Polkit while handling DBus messages. Some DBus interfaces use a cache to store objects for a short period and clean cache elements as soon as the DBus bus becomes free to handle other requests. If a DBus method handler uses bus_verify_polkit_async(), it may need to wait for the action in Polkit to complete. Once Polkit is ready, the handler is called again and accesses previously allocated memory data. If the request to Polkit takes too long, the elements in the cache may be cleared before the DBus method handler is called a second time.
Among the services that allow for the exploitation of the vulnerability is systemd-machined, which provides the DBus API org.freedesktop.machine1.Image.Clone, leading to temporary data storage in the cache and asynchronous access to Polkit. The interface
org.freedesktop.machine1.Image.Clone is available to all unprivileged users of the system, who can initiate crashes of systemd services or potentially execute code with root privileges (an exploit prototype has not yet been demonstrated). The code allowing exploitation of the vulnerability was in systemd-machined in 2015 in version (RHEL 7.x uses systemd 219).
Source: opennet.ru
