CyberRota Analysis
AI-GeneratedUnprivileged users logged into a graphical desktop session on systems running systemd-machined version 259 or later can terminate arbitrary processes, including those with elevated privileges, potentially leading to service disruption or unauthorized access. This vulnerability primarily affects environments where systemd-machined is installed and configured with specific polkit permissions, making it crucial for organizations utilizing this service in desktop settings to prioritize remediation. Users operating in terminal-only or remote sessions, as well as those with versions prior to 258, are not impacted.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected