In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.

In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.

systemd: systemd: Privilege escalation via improper access control in RegisterMachine D-Bus method systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data systemd: systemd: Local unprivileged user can cause Denial of Service systemd: systemd-machined: Local privilege escalation via varlink systemd: udev in systemd: Privilege escalation via malicious hardware devices and unsanitized kernel output systemd: systemd nspawn: Escape-to-host action via crafted config file systemd: systemd: Denial of Service via malicious IPC API call with null element systemd: systemd-journald: Unintended output to user terminals via logger command

Withdrawn by the publisher.

Affected: Ubuntu:Pro:14.04:LTS: systemd, Ubuntu:Pro:16.04:LTS: systemd, Ubuntu:Pro:18.04:LTS: systemd, Ubuntu:Pro:20.04:LTS: systemd, Ubuntu:22.04:LTS: systemd, Ubuntu:24.04:LTS: systemd, Ubuntu:25.10: systemd, Ubuntu:26.04:LTS: systemd

In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.

Ein lokaler Angreifer kann mehrere Schwachstellen in systemd ausnutzen, um einen Denial of Service Angriff durchzuführen oder Daten zu manipulieren.