7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
20.7%
Severity: High
Date : 2020-02-12
CVE-ID : CVE-2020-1712
Package : systemd
Type : privilege escalation
Remote : No
Link : https://security.archlinux.org/AVG-1094
The package systemd before version 244.2-1 is vulnerable to privilege
escalation.
Upgrade to 244.2-1.
The problem has been fixed upstream in version 244.2.
None.
A heap use-after-free vulnerability was found in systemd before version
244.2, where asynchronous Polkit queries are performed while handling
dbus messages. A local unprivileged attacker can abuse this flaw to
crash systemd services or potentially execute code and elevate their
privileges, by sending specially crafted dbus messages.
A local unprivileged attacker is able to crash the system or execute
arbitrary code as root by abusing polkit caching mechanisms.
https://github.com/systemd/systemd/commit/ea0d0ede03c6f18dbc5036c5e9cccf97e415ccc2
https://github.com/systemd/systemd-stable/commit/e2d4cb9843c50eff76e9104fec6b448c0d7c8814
https://security.archlinux.org/CVE-2020-1712
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
20.7%