OSG-SEC-2022-08-26 HIGH Linux systemd use-after-free vulnerability

Dear OSG Security Contacts,

Vulnerabilities have been found concerning a user-after-free vulnerability in systemd when dealing with DNSStream which may allow an unprivileged user on a local or adjacent network to gain access to the affected system [1][7].

IMPACTED VERSIONS:

Most major Linux distributions.

WHAT ARE THE VULNERABILITIES:

A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later. [7]

WHAT YOU SHOULD DO:

Update affected systems as patches are made available and restart them.

Sites running RHEL should see [1]

Sites running CentOS should also see [1]

Sites running Ubuntu should see [2]

Sites running Scientific Linux should see [3]

Sites running Debian should see [4]

Sites running RockyLinux should see [5]

Sites running Almalinux should see [6]

REFERENCES

[1] https://access.redhat.com/security/cve/CVE-2022-2526

[2] https://ubuntu.com/security/CVE-2022-2526

[3] https://www.scientificlinux.org/category/sl-errata/

[4] https://security-tracker.debian.org/tracker

[5] https://errata.rockylinux.org/

[6] https://errata.almalinux.org/

[7] https://vulners.com/redhatcve/RH:CVE-2022-2526

Please contact the OSG security team at [email protected] if you have any questions or concerns.

OSG Security Team