Vulnerability in Red Hat, Inc. Systemd
CVE-2018-1049
In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted.
Vulnerability class: Race Condition
EPSS: 0.072 (93.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Red Hat, Inc. Systemd — versions prior to 234
- Systemd_project Systemd
- Canonical Ubuntu_linux — versions 14.04, 16.04
- Debian Debian_linux — versions 8.0
- Redhat Enterprise_linux — versions 7.0
- Redhat Enterprise_linux_aus — versions 7.4, 7.6
- Redhat Enterprise_linux_desktop — versions 7.0
- Redhat Enterprise_linux_server — versions 7.0
- Redhat Enterprise_linux_server_aus — versions 7.4, 7.6
- Redhat Enterprise_linux_server_eus — versions 7.4, 7.5, 7.6
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- secalert@redhat.com (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Patch, Third Party Advisory, Issue Tracking)
- secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-1049?
- CVE-2018-1049 is a medium-severity vulnerability in Red Hat, Inc. Systemd, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 5.9/10. Published 2018-02-16.
- How severe is CVE-2018-1049?
- Medium severity. CVSS v3 base score is 5.9 out of 10.
- Is CVE-2018-1049 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.