Multiple vulnerabilities have been discovered in systemd, the worst of which could result in denial of service.

Announced

2023-05-03

Revised

2024-02-11 (revision 2)

Access

remote

Bugs

#880547 #830967

Advisory

https://security.gentoo.org/glsa/202305-15

Affected packages

Package	Arch	Vulnerable	Unaffected
sys-apps/systemd	*	< 251.3	>= 251.3
sys-apps/systemd-tmpfiles	*	<= 250	—
sys-apps/systemd-utils	*	< 251.3	>= 251.3
sys-fs/udev	*	<= 250	—

Background

A system and service manager.

Description

Multiple vulnerabilities have been discovered in systemd. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All systemd users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-apps/systemd-251.3"

All systemd-utils users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-apps/systemd-utils-251.3"

Gentoo has discontinued support for sys-apps/systemd-tmpfiles, sys-boot/systemd-boot, and sys-fs/udev. See the 2022-04-19-systemd-utils news item. Users should unmerge it in favor of sys-apps/systemd-utils on non-systemd systems:

# emerge --ask --depclean --verbose "sys-apps/systemd-tmpfiles" "sys-boot/systemd-boot" "sys-fs/udev"
# emerge --ask --verbose --oneshot ">=sys-apps/systemd-utils-251.3"

References

• CVE-2021-3997
• CVE-2022-3821