CVE-2019-6454

What it actually does

Variable-length stack buffer allocation in bus_process_object() for D-Bus object paths allows an unprivileged local process to send a crafted message that advances the stack pointer beyond guard pages into unmapped memory, crashing PID 1.

Why it matters to the business

A local user can trigger an immediate system-wide denial of service by forcing a kernel panic, halting all services until manual reboot; the issue affects core system stability on distributions shipping the vulnerable systemd version.

How an attack unfolds

An attacker with a local account crafts a D-Bus message containing an oversized object path, sends it directly to PID 1 over the system bus, and causes the stack guard page bypass that terminates the init process.

How to fix it

Upgrade the affected systemd package to a version containing the fix for bus-objects.c; for the listed php/php-src (GIT) component apply commit e2a082c4a94bc62dfc1d2119d4ce3301632bdfdb or later equivalent backport.

How to confirm the fix worked

Confirm the running systemd version is newer than 239 and that the patched bus_process_object() logic is present; attempt to reproduce the crash with a minimal proof-of-concept message only in an isolated test environment.

Typical attack path

1. Obtain unprivileged local shell access
2. Connect to the system D-Bus socket
3. Construct and transmit a malicious D-Bus message targeting PID 1 with an oversized object path
4. Trigger stack-pointer advancement past guard pages
5. Observe PID 1 crash and kernel panic

How to detect it

Review system logs for sudden systemd or kernel panic entries around the time of suspected activity; look for processes that opened the system D-Bus socket and then terminated abnormally.

What your security team should do

• Apply the fixed package version immediately on all reachable systems
• Restrict unprivileged access to the system D-Bus where operationally feasible
• Monitor for unexpected PID 1 restarts in system logs
• Include the vulnerability in the next patch-window planning given its local attack surface