Arch Linux Security Advisory ASA-202002-8 ========================================= Severity: High Date : 2020-02-12 CVE-ID : CVE-2020-1712 Package : systemd Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1094 Summary ======= The package systemd before version 244.2-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 244.2-1. # pacman -Syu "systemd>=244.2-1" The problem has been fixed upstream in version 244.2. Workaround ========== None. Description =========== A heap use-after-free vulnerability was found in systemd before version 244.2, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages. Impact ====== A local unprivileged attacker is able to crash the system or execute arbitrary code as root by abusing polkit caching mechanisms. References ========== https://github.com/systemd/systemd/commit/ea0d0ede03c6f18dbc5036c5e9cccf97e4... https://github.com/systemd/systemd-stable/commit/e2d4cb9843c50eff76e9104fec6... https://security.archlinux.org/CVE-2020-1712