CVE-2018-16865

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-16865
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://packetstormsecurity.com/files/152841/System-Down-A-systemd-journald-Exploit.html Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2019/May/21 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/05/10/4 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/07/20/2 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/106525 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHBA-2019:0327 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0049 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0204 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0271 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0342 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0361 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2402 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16865 Issue Tracking Patch
https://lists.debian.org/debian-lts-announce/2019/01/msg00016.html Mailing List Third Party Advisory
https://seclists.org/bugtraq/2019/May/25 Mailing List Third Party Advisory
https://security.gentoo.org/glsa/201903-07 Third Party Advisory
https://security.netapp.com/advisory/ntap-20190117-0001/ Third Party Advisory
https://usn.ubuntu.com/3855-1/ Third Party Advisory
https://www.debian.org/security/2019/dsa-4367 Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch Third Party Advisory
https://www.qualys.com/2019/01/09/system-down/system-down.txt Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:a:oracle:communications_session_border_controller:8.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_session_border_controller:8.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_session_border_controller:8.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_communications_broker:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_communications_broker:3.1.0:*:*:*:*:*:*:*
History

13 Feb 2023, 04:52

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2018-16865', 'name': 'https://access.redhat.com/security/cve/CVE-2018-16865', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1653861', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1653861', 'tags': [], 'refsource': 'MISC'}
Summary An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable.

02 Feb 2023, 21:18

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2018-16865 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1653861 -
Summary An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable. An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges.

31 Jan 2022, 18:34

Type Values Removed Values Added
First Time Systemd Project
Systemd Project systemd
CPE cpe:2.3:a:freedesktop:systemd:*:*:*:*:*:*:*:* cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*
References
  • (MLIST) http://www.openwall.com/lists/oss-security/2021/07/20/2 - Mailing List, Third Party Advisory
References (MLIST) http://www.openwall.com/lists/oss-security/2019/05/10/4 - Mailing List (MLIST) http://www.openwall.com/lists/oss-security/2019/05/10/4 - Mailing List, Third Party Advisory
Information

Published : 2019-01-11 21:29

Updated : 2023-12-10 12:44

NVD link : CVE-2018-16865

Mitre link : CVE-2018-16865

CVE.ORG link : CVE-2018-16865

JSON object : View

Products Affected

debian

  • debian_linux

redhat

  • enterprise_linux_server_eus
  • enterprise_linux_server_aus
  • enterprise_linux_server_tus
  • enterprise_linux_server
  • enterprise_linux_workstation
  • enterprise_linux_desktop

oracle

  • communications_session_border_controller
  • enterprise_communications_broker

systemd_project

  • systemd

canonical

  • ubuntu_linux
CWE
CWE-770

Allocation of Resources Without Limits or Throttling