CVE-2019-3842 describes a vulnerability in systemd versions prior to v242-rc4, specifically within the pam_systemd module, affecting products like Debian, Fedora, and Red Hat. An attacker can manipulate the XDG_SEAT environment variable to bypass polkit policy checks, allowing commands to be evaluated with "allow_active" instead of "allow_any" in certain configurations. This vulnerability carries a high CVSS score of 7.0, indicating a local attack vector with high impact on confidentiality, integrity, and availability, though with high attack complexity. There is no evidence of active exploitation, and while an ExploitDB entry (EDB-46743) exists, there is no Metasploit or Nuclei support, and minimal community or media discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 241CPE matchmatch criteria | cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:* | ||
242CPE matchmatch criteria | cpe:2.3:a:systemd_project:systemd:242:rc1:*:*:*:*:*:* | ||
242CPE matchmatch criteria | cpe:2.3:a:systemd_project:systemd:242:rc2:*:*:*:*:*:* | ||
242CPE matchmatch criteria | cpe:2.3:a:systemd_project:systemd:242:rc3:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.4 InfoSec Media, 0.1 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2019-3842
Aug 11, 2020In systemd before v242-rc4 it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker in some particular configurations to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".
Apr 9, 2019systemd: Spoofing of XDG_SEAT allows for actions to be checked against "allow_active" instead of "allow_any"
Apr 8, 2019