Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-94hk-2ehw-bqds
Vulnerability ID VCID-94hk-2ehw-bqds
Aliases CVE-2019-3844
Summary systemd: services with DynamicUser can get new privileges and create SGID binaries
Status Published
Exploitability 2.0
Weighted Severity 4.0
Risk 8.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-268 Privilege Chaining
System Score Found at
cvssv3 4.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-3844.json
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2019-3844
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2019-3844
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2019-3844
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2019-3844
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2019-3844
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2019-3844
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2019-3844
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2019-3844
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2019-3844
cvssv3 4.5 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3844
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3844
cvssv3 4.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3 4.5 https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
ssvc Track https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
cvssv3 4.5 https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
ssvc Track https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
cvssv3 4.5 https://security.netapp.com/advisory/ntap-20190619-0002/
ssvc Track https://security.netapp.com/advisory/ntap-20190619-0002/
cvssv3 4.5 https://usn.ubuntu.com/4269-1/
ssvc Track https://usn.ubuntu.com/4269-1/
cvssv3 4.5 http://www.securityfocus.com/bid/108096
ssvc Track http://www.securityfocus.com/bid/108096
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-3844.json
https://api.first.org/data/v1/epss?cve=CVE-2019-3844
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3844
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
108096 http://www.securityfocus.com/bid/108096
1684610 https://bugzilla.redhat.com/show_bug.cgi?id=1684610
928102 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=928102
ntap-20190619-0002 https://security.netapp.com/advisory/ntap-20190619-0002/
RHSA-2020:1794 https://access.redhat.com/errata/RHSA-2020:1794
show_bug.cgi?id=CVE-2019-3844 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3844
USN-4269-1 https://usn.ubuntu.com/4269-1/
Data source Exploit-DB
Date added April 26, 2019
Description systemd - DynamicUser can Create setuid Binaries when Assisted by Another Process
Ransomware campaign use Known
Source publication date April 26, 2019
Exploit type dos
Platform linux
Source update date April 26, 2019
Source URL https://bugs.chromium.org/p/project-zero/issues/detail?id=1771
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-3844.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3844
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-09T15:49:10Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3844
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-09T15:49:10Z/ Found at https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-09T15:49:10Z/ Found at https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://security.netapp.com/advisory/ntap-20190619-0002/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-09T15:49:10Z/ Found at https://security.netapp.com/advisory/ntap-20190619-0002/
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://usn.ubuntu.com/4269-1/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-09T15:49:10Z/ Found at https://usn.ubuntu.com/4269-1/
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at http://www.securityfocus.com/bid/108096
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-09T15:49:10Z/ Found at http://www.securityfocus.com/bid/108096
Exploit Prediction Scoring System (EPSS)
Percentile 0.35654
EPSS Score 0.00151
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T14:19:54.997204+00:00 RedHat Importer Import https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-3844.json 38.0.0