D-Bus Messaging Vulnerability in Systemd 240 Affects Red Hat and Fedora

CVE-2019-15718

What is CVE-2019-15718?

In systemd version 240, a vulnerability exists due to improper handling of D-Bus message access controls. Specifically, the function bus_open_system_watch_bind_with_description in shared/bus-util.c, utilized by systemd-resolved, invokes sd_bus_set_trusted. This action inadvertently allows unprivileged users to bypass essential access controls. Consequently, they can execute D-Bus methods that should be restricted to privileged users, potentially altering the system's DNS resolver settings. This poses a significant risk of unauthorized DNS manipulation, which could lead to broader security implications.

References