Version the issue has been seen with

245 ea500ac and the current master d904afc

Used distribution

Ubuntu 20.04 LTS

Expected behaviour you didn't see

loginctl show-user $(id -u)

UID=1000
GID=1000
Name=0x2b3bfa0
Timestamp=Sat 2020-05-30 23:37:28 CEST
TimestampMonotonic=405537243
RuntimePath=/run/user/1000
Service=user@1000.service
Slice=user-1000.slice
Display=2
State=active
Sessions=16 2
IdleHint=no
IdleSinceHint=1590909501087020
IdleSinceHintMonotonic=5138907865
Linger=no

Unexpected behaviour you saw

loginctl show-user $(id -u)

Failed to get user: User ID 1000 is not logged in or lingering

Steps to reproduce the problem

1. Create a user whose name starts with 0x or 0X (exempli gratia: 0x2b3bfa0).
2. Log in with that user name and run loginctl show-user $(id -u).
3. Check the unexpected behavior above.

Affected code

Problem description
As per the strtoul(3) man page, when the base argument is 0, the string can also be interpreted as an hexadecimal or octal number:

If base is zero or 16, the string may then include a "0x" prefix, and the number will be read in base 16; otherwise, a zero base is taken as 10 (decimal) unless the next character is '0', in which case it is taken as 8 (octal).

Vulnerability

CVE-2020-13776: systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended.

Related issues

• Unable to start user session when logged in as active directory user on systemd 245 #15149
• systemd can't handle the process previlege that belongs to user name startswith number, such as 0day #6237