CVE-2021-33910

CVE-2021-33910 affects systemd prior to versions 246.15, 247.8, 248.5, and 249.1. The root cause is a Memory Allocation with an Excessive Size Value in basic/unit-name.c involving strdupa and alloca for a pathname controlled by a local attacker, leading to a crash of the operating system (denial ...

CVE-2019-20386

CVE-2019-20386 affects systemd and is caused by a memory leak in button_open() invoked when handling udev events via login/logind-button.c, enabling local DoS under certain conditions. Public doks confirm exploit path through udevadm trigger to trigger memory leak and potential denial of service....

CVE-2019-6454

CVE-2019-6454 affects systemd’s bus_process_object() which allocates a large stack buffer for the object path in D-Bus messages. A locally unprivileged user can send a crafted message to PID1, causing the stack pointer to jump past guard pages and crash systemd PID1, potentially triggering a kern...

CVE-2021-3997

CVE-2021-3997 affects systemd with an uncontrolled recursion in systemd-tmpfiles that can cause a denial of service at boot when many nested /tmp directories are created. Connected documents confirm the issue and indicate remediation through updated systemd packages (e.g., Mariner cites versions

CVE-2022-4415

CVE-2022-4415 affects systemd and related components, with the root cause in systemd-coredump not respecting fs.suid_dumpable, enabling local information leakage. Affected packages include systemd and systemd-coredump across distributions; older releases (pre-patched) are vulnerable. The exploita...

CVE-2023-7008

CVE-2023-7008 affects systemd-resolved in systemd by allowing DNSSEC-signed domains to be accepted even when unsigned, enabling record manipulation by an attacker via MITM or upstream resolver. Connected advisories confirm a fix is available in patched systemd packages (e.g., Debian 247.3-7+deb11...

CVE-2018-1049

CVE-2018-1049 describes a race condition in systemd prior to version 234 between .mount and .automount units, where automount requests from the kernel may not be serviced, causing the mountpoint to hang for affected processes and leading to denial of service. Connected advisories and Nessus plugi...

CVE-2022-3821

The CVE-2022-3821 issue is an off-by-one buffer overrun in systemd’s format_timespan() within time-util.c that can cause a Denial of Service when specific time and accuracy values are supplied. Multiple connected sources confirm the vulnerability in systemd and reference a patched package update ...

CVE-2023-31437

Summary: CVE-2023-31437 affects systemd 253. An attacker could modify a sealed log file so that, in some views, not all existing and sealed log messages are displayed. The vendor reportedly denied this as a vulnerability. The connected sources (NVD, OSV entries) describe the issue but do not prov...

CVE-2023-31439

CVE-2023-31439 : Affects systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file so that integrity checking shows no error, despite modifications. The Initial Description notes the vendor replied denying that this finding is a security vulnera...

CVE-2022-45873

CVE-2022-45873 affects systemd 250/251, enabling a local attacker to trigger a crash in systemd-coredump via a recursive crash in parse_elf_object, building an excessively deep backtrace that can deadlock the service. Exploitation described as calling the same function recursively and placing the...

CVE-2013-4392

CVE-2013-4392 pertains to systemd: during file permission updates, a symlink attack on unspecified files lets local users change permissions and SELinux contexts of arbitrary files. Root cause is a symlink-based manipulation affecting file metadata via systemd’s permission-update logic. The CVSS ...

CVE-2016-7796

The CVE-2016-7796 vulnerability affects the systemd manager_dispatch_notify_fd path, where a local user can send a zero-length message on the notify socket, causing an error, disabling the notification handler and potentially leading to a system hang. Connected advisories (e.g., SUSE/OpenVAS/OSV ...

CVE-2016-7795

CVE-2016-7795 affects systemd 231 and earlier, where manager_invoke_notify_message processes a zero-length notify socket message, enabling local users to trigger denial of service (assertion failure and PID 1 hang). Connected advisories (e.g., MiracleLinux AXSA-2016-832:08 and EulerOS security ad...

CVE-2026-29111

CVE-2026-29111: systemd local unprivileged user can trigger an assert via an unprivileged IPC API call with spurious data. The issue affects versions from v239 onward; older than v239 are not affected, while v249 and older exhibited stack overwriting, attacker-controlled content. Patches exist in...

CVE-2013-4394

CVE-2013-4394 concerns systemd’s SetX11Keyboard function. When PKLA is used to change group permissions on XKB layouts, local users in that group may modify the Xorg X11 Server configuration file and potentially gain privileges through vectors involving special and control characters. The vulnera...

CVE-2012-1101

CVE-2012-1101 affects systemd 37-1. The issue occurs when non-existent services are not handled properly, resulting in a denial of service during login. The impact described is a failure of the login procedure with an availability impact. The connected documents provide this same description and ...

CVE-2023-31438

Mode C: Affected product: systemd 253. Issue: attacker can truncate a sealed log file and then resume log sealing to make integrity checks pass despite modifications. Connected Red Hat doc for CVE-2023-31438 repeats this description and notes the vendor’s reply denying that it is a security vulne...

CVE-2026-40223

Affected software: systemd, versions 258 prior to 260. Vulnerability: local unprivileged user can trigger an assertion if a Delegate=yes and User= unit exists and is running. Root cause: assertion path in systemd when the unit condition is met. Impact: results in an assertion (denial of service v...