It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.
NOTE: The following CVSS v3.0 metrics and score provided are preliminary and subject to review.
|Base Score:||7.8||Base Metrics:||AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H|
|Access Vector:||Local network||Attack Complexity:||Low|
|Privileges Required:||Low||User Interaction:||None|
|Integrity Impact:||High||Availability Impact:||High|
|Oracle Linux version 8 (systemd)||ELSA-2020-1794||2020-05-05|
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team