systemd: Multiple Vulnerabilities — GLSA 202305-15

Multiple vulnerabilities have been discovered in systemd, the worst of which could result in denial of service.

Affected packages

sys-apps/systemd on all architectures
Affected versions < 251.3
Unaffected versions >= 251.3
sys-apps/systemd-tmpfiles on all architectures
Affected versions <= 250
Unaffected versions
sys-apps/systemd-utils on all architectures
Affected versions < 251.3
Unaffected versions >= 251.3
sys-fs/udev on all architectures
Affected versions <= 250
Unaffected versions

Background

A system and service manager.

Description

Multiple vulnerabilities have been discovered in systemd. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All systemd users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=sys-apps/systemd-251.3"
 

All systemd-utils users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=sys-apps/systemd-utils-251.3"
 

Gentoo has discontinued support for sys-apps/systemd-tmpfiles, sys-boot/systemd-boot, and sys-fs/udev. See the 2022-04-19-systemd-utils news item. Users should unmerge it in favor of sys-apps/systemd-utils on non-systemd systems:

 # emerge --ask --depclean --verbose "sys-apps/systemd-tmpfiles" "sys-boot/systemd-boot" "sys-fs/udev"
 # emerge --ask --verbose --oneshot ">=sys-apps/systemd-utils-251.3"
 

References

Release date
May 03, 2023

Latest revision
February 11, 2024: 2

Severity
normal

Exploitable
remote

Bugzilla entries