5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-31437

CVE-2023-31437: An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in...

An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-31437

CVE-2023-31437:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2023-31437 allows an attacker to modify a sealed log file such that some log messages are not displayed. The provided patch file CVE-2023-31437.patch modifies src/libsystemd/sd-journal/journal-verify.c.

The function verify_data was patched to add specific checks ensuring that data objects correctly link back to their entry objects. The absence of this check in the original version of verify_data made it vulnerable, as manipulated linkages could lead to hidden entries.
The main verification function journal_file_verify was patched to include a call to a new function verify_field_hash_table. This new function performs extensive checks on the field hash table, which is crucial for log filtering. The original journal_file_verify lacked these comprehensive checks, making the overall verification process susceptible to manipulations that could hide log entries when filters are applied.

The functions verify_data and journal_file_verify are identified as vulnerable because they processed the potentially malicious log file structure without these crucial integrity checks, which the patch introduces. The newly added function verify_field_hash_table is part of the mitigation, not a vulnerable function itself.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.