CVE-2019-18903
📋 TL;DR
A use-after-free vulnerability in the wicked network configuration service for SUSE Linux systems allows remote attackers to cause denial of service or potentially execute arbitrary code. This affects SUSE Linux Enterprise Server 12 and 15, openSUSE Leap 15.1, and openSUSE Factory systems running vulnerable versions of wicked.
💻 Affected Systems
- wicked network configuration service
📦 What is this software?
Leap by Opensuse
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with root privileges leading to complete system compromise
Likely Case
Denial of service causing network service disruption and system instability
If Mitigated
Limited impact if network exposure is restricted and proper segmentation is in place
🎯 Exploit Status
Use-after-free vulnerabilities require specific memory manipulation knowledge but remote exploitation is possible. No public exploit code was found in initial research.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: SUSE Linux Enterprise Server 12: 0.6.60-2.18.1 or later; SUSE Linux Enterprise Server 15: 0.6.60-28.26.1 or later; openSUSE Leap 15.1: 0.6.60-lp151.2.9.1 or later; openSUSE Factory: 0.6.62 or later
Vendor Advisory: https://bugzilla.suse.com/show_bug.cgi?id=1160904
Restart Required: Yes
Instructions:
1. Update system packages using 'sudo zypper update wicked' 2. Restart wicked service with 'sudo systemctl restart wicked' 3. Verify service is running with 'sudo systemctl status wicked'
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to wicked service using firewall rules
sudo firewall-cmd --permanent --remove-service=wicked
sudo firewall-cmd --reload
Service Disablement
linuxDisable wicked service if not required for system operation
sudo systemctl stop wicked
sudo systemctl disable wicked
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected systems
- Monitor system logs for unusual wicked service activity and crashes
🔍 How to Verify
Check if Vulnerable:
Check wicked version with 'rpm -q wicked' and compare against patched versionsCheck Version:
rpm -q wickedVerify Fix Applied:
Verify version is updated and service is running without crashes📡 Detection & Monitoring
Log Indicators:
- wicked service crashes in system logs
- unexpected memory access errors related to wicked
Network Indicators:
- unusual network traffic to wicked service port
- connection attempts to wicked from unexpected sources
SIEM Query:
process.name:"wicked" AND (event.action:"crash" OR event.outcome:"failure")