Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2019-3844 Details

Description

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3844 CVEIssue TrackingPatchThird Party Advisory
https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E CVE
https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E CVE
https://security.netapp.com/advisory/ntap-20190619-0002/ CVEThird Party Advisory
https://usn.ubuntu.com/4269-1/ CVEThird Party Advisory

see all 12 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-268Privilege Chaining[email protected]
NVD-CWE-noinfoInsufficient Information to Classify Weakness[email protected]

Affected Products

ProductVersions

Change History

14 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2019-3844
NVD Published Date:
Apr 26, 2019
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2019-3844 Details - Not Deferred