CVE-2020-1712
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages.
Published Mar 31, 2020 · updated Oct 14, 2026 · systemd project systemd
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 31, 2020 · NIST NVD
Detected
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
Oct 14, 2026 · NIST NVD
Updated
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
Affected
- cpe debian/debian linux9.0
- cpe redhat/ceph storage4.0
- cpe redhat/discoveryversion unspecified
- cpe redhat/enterprise linux8.0
- cpe redhat/migration toolkit1.0
- cpe redhat/openshift container platform4.0
- cpe systemd project/systemdversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2020-1712
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2020-1712
30-day exploitation probability 0.5%
first.org - NIST NVDVulnerability recordCVE-2020-1712
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate thei
nvd.nist.gov