CVE-2019-6454: Canonical Ubuntu Linux

Medium severity, CVSS 5.5. EPSS: 2% chance of exploitation in the next 30 days.

An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).

Affected products

Canonical Ubuntu Linux: version 16.04 only; version 18.04 only; version 18.10 only
Debian Debian Linux: version 8.0 only; version 9.0 only
Fedoraproject Fedora: version 29 only
McAfee Web Gateway: before 7.7.2.21 (fixed in 7.7.2.21); from 7.8.0, before 7.8.2.8 (fixed in 7.8.2.8); from 8.0.0, before 8.1.1 (fixed in 8.1.1)
Netapp Active Iq Performance Analytics Services: affected versions not specified
Opensuse Leap: version 15.0 only
Red Hat Enterprise Linux: version 8.0 only
Red Hat Enterprise Linux Compute Node Eus: version 7.5 only
Red Hat Enterprise Linux Desktop: version 7.0 only
Red Hat Enterprise Linux Eus: version 7.4 only; version 7.5 only; version 8.1 only; version 8.2 only; version 8.4 only
Red Hat Enterprise Linux For IBM Z Systems Eus: version 7.4 only; version 7.5 only; version 8.1 only; version 8.2 only; version 8.4 only
Red Hat Enterprise Linux For Power Big Endian Eus: version 7.4 only
Red Hat Enterprise Linux For Power Little Endian: version 8.0 only
Red Hat Enterprise Linux For Power Little Endian Eus: version 7.4 only; version 7.5 only; version 8.1 only; version 8.2 only; version 8.4 only
Red Hat Enterprise Linux Server: version 7.0 only
Red Hat Enterprise Linux Server Aus: version 7.3 only; version 7.4 only; version 7.6 only; version 8.2 only; version 8.4 only
Red Hat Enterprise Linux Server Eus: version 7.6 only
Red Hat Enterprise Linux Server For Power Little Endian Update Services For SAP Solutions: version 7.3 only; version 7.4 only; version 8.0 only; version 8.1 only; version 8.2 only
Red Hat Enterprise Linux Server Tus: version 7.3 only; version 7.4 only; version 7.6 only; version 8.2 only; version 8.4 only
Red Hat Enterprise Linux Server Update Services For SAP Solutions: version 7.3 only; version 7.4 only; version 8.0 only; version 8.1 only; version 8.2 only
Red Hat Enterprise Linux Workstation: version 7.0 only
Systemd Project Systemd: version 239 only

Published 2019-03-21. Last modified 2026-06-17.