It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future when the GID will be recycled.

🗓️ 18 Aug 2020 07:00:00Reported by MicrosoftType

Systemd DynamicUser with setuid binaries enables privilege escalation to create setgid binaries owned by the service group.

Reporter	Title	Published	Views	Family All 52
zdt	systemd DynamicUser SetUID Binary Creation Exploit	26 Apr 201900:00	–	zdt
AstraLinux	Astra Linux – Vulnerability in Systemd	20 May 202605:53	–	astralinux
BDU FSTEC	The vulnerability of the systemd service initialization and management subsystem, related to improper privilege binding, allows a malicious actor to gain access to confidential data, compromise its integrity, and cause service failures.	20 Jan 202200:00	–	bdu_fstec
CBLMariner	CVE-2019-3844 affecting package systemd 239-44	30 Nov 202019:30	–	cbl_mariner
Tenable Nessus	CentOS 8 : systemd (CESA-2020:1794)	1 Feb 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : systemd (EulerOS-SA-2019-1661)	27 Jun 201900:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.3.0 : systemd (EulerOS-SA-2019-2319)	3 Dec 201900:00	–	nessus
Tenable Nessus	Oracle Linux 8 : systemd (ELSA-2020-1794)	7 Sep 202300:00	–	nessus
Tenable Nessus	Photon OS 3.0: Systemd PHSA-2019-3.0-0024	26 Aug 201900:00	–	nessus
Tenable Nessus	RHEL 8 : systemd (RHSA-2020:1794)	28 Apr 202000:00	–	nessus