Skip to content
Fencer Vulns
medium 4.5

CVE-2019-3844 json

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, whic…

published 2019-04-26 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-13464

cvss
4.5
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits
1
Exploit-DB

Summary

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.

Patch / fix

  • systemd_project systemd 242
  • systemd Debian 14, Debian 13, Debian 12 242-4

debian advisories DEBIAN-CVE-2019-3844

  • systemd Ubuntu 18.04 LTS 237-3ubuntu10.38

ubuntu advisories UBUNTU-CVE-2019-3844

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • systemd RHEL 8 239-29.el8
  • systemd-pam RHEL 8 239-29.el8
  • systemd-libs RHEL 8 239-29.el8
  • systemd-udev RHEL 8 239-29.el8
  • systemd-tests RHEL 8 239-29.el8
  • systemd-container RHEL 8 239-29.el8
  • systemd-journal-remote RHEL 8 239-29.el8

red hat advisories RHSA-2020:1794

  • systemd SLE Module for Basesystem 15 SP1, SLE Module for Basesystem 15 234-24.30.1

suse advisories SUSE-SU-2019:1364-2SUSE-SU-2019:1364-1

  • systemd openSUSE Tumbleweed 249.4-2.2

opensuse advisories openSUSE-SU-2024:11420-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-3844 updated cvss 4.5

systemd: services with DynamicUser can get new privileges and create SGID binaries

  • Red Hat Enterprise Linux BaseOS (v. 8) systemd 239-29.el8, systemd-pam 239-29.el8, systemd-libs 239-29.el8, systemd-udev 239-29.el8, systemd-tests 239-29.el8, systemd-container 239-29.el8, +1 more
    fixed: vendor fix RHSA-2020:1794
  • Red Hat Enterprise Linux 7 systemd, libgudev1, systemd-libs, systemd-sysv, systemd-python, systemd-networkd, +2 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-46760)
  2. Published

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
17 mo ago

Exploit prediction

0.92% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-46760 systemd - DynamicUser can Create setuid Binaries when Assisted by Another Process dos, 2019-04-26

CVSS scores

assigned by version score vector
CNA 3.0 4.5 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • [freedesktop.org] systemd

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.