Local Vulnerability in systemd Affects Users with Version 250 and 251

CVE-2022-45873

What is CVE-2022-45873?

Local users may exploit a vulnerability in systemd versions 250 and 251, leading to a deadlock scenario within the systemd-coredump service. This issue arises during the parsing of ELF objects when a binary, designed to recursively call the same function, is crashed. By nesting this binary in deeply nested directories to elongate the backtrace, users can trigger a systemd-coredump deadlock, particularly under conditions set by the MaxConnections parameter. This vulnerability necessitates multiple sequential activations to fully exploit the situation, potentially impacting system reliability.

References