CVE-2020-1712
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages.
Published Mar 31, 2020 · updated Oct 14, 2026 · systemd project systemd
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
Timeline
Detection, updates, and resolution for this record.
Mar 31, 2020 · NIST NVD
Detected
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
Oct 14, 2026 · NIST NVD
Updated
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
Affected
- cpe debian/debian linux9.0
- cpe redhat/ceph storage4.0
- cpe redhat/discoveryversion unspecified
- cpe redhat/enterprise linux8.0
- cpe redhat/migration toolkit1.0
- cpe redhat/openshift container platform4.0
- cpe systemd project/systemdversion unspecified
Sources
- CVE.orgCVE-2020-1712
Official CVE identifier
cve.org - FIRST EPSSCVE-2020-1712
30-day exploitation probability 0.5%
first.org - NIST NVDCVE-2020-1712
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate thei
nvd.nist.gov