USN-5928-1: systemd vulnerabilities

Releases

• Ubuntu 22.10
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM
• Ubuntu 14.04 ESM

Packages

• systemd - system and service manager

Details

It was discovered that systemd did not properly validate the time and
accuracy values provided to the format_timespan() function. An attacker
could possibly use this issue to cause a buffer overrun, leading to a
denial of service attack. This issue only affected Ubuntu 14.04 ESM, Ubuntu
16.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.
(CVE-2022-3821)

It was discovered that systemd did not properly manage the fs.suid_dumpable
kernel configurations. A local attacker could possibly use this issue to
expose sensitive information. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-4415)

It was discovered that systemd did not properly manage a crash with long
backtrace data. A local attacker could possibly use this issue to cause a
deadlock, leading to a denial of service attack. This issue only affected
Ubuntu 22.10. (CVE-2022-45873)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 22.10

• systemd - 251.4-1ubuntu7.1

Ubuntu 22.04

• systemd - 249.11-0ubuntu3.7

Ubuntu 20.04

• systemd - 245.4-4ubuntu3.20

Ubuntu 18.04

• systemd - 237-3ubuntu10.57

Ubuntu 16.04

• systemd - 229-4ubuntu21.31+esm3
  Available with Ubuntu Pro

Ubuntu 14.04

• systemd - 204-5ubuntu20.31+esm2
  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

• CVE-2022-3821
• CVE-2022-45873
• CVE-2022-4415