Local privilege escalation via numeric username parsing

Improper privilege management in systemd 245 and earlier allows local users to gain elevated privileges through a numeric User= value. The user-util.c UID parser accepts account-name strings with numeric prefixes, so a hexadecimal name such as 0x0 is resolved as the corresponding numeric UID instead of through the account database. Exploitation requires an administrator-created service unit with the crafted User= name, a corresponding account, and attacker control of the executed program; UID 0 yields root execution.