Published: 26/10/2018 Updated: 20/04/2023

CVSS v2 Base Score: 6.9 | Impact Score: 10 | Exploitability Score: 3.4

CVSS v3 Base Score: 7 | Impact Score: 5.9 | Exploitability Score: 1

VMScore: 695

Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C

A race condition in chown_one() of systemd allows an malicious user to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239.

Vulnerable Product	Search on Vulmon	Subscribe to Product
canonical ubuntu linux 16.04
canonical ubuntu linux 18.04
canonical ubuntu linux 18.10
systemd project systemd

Debian Bug report logs - #912007 systemd: CVE-2018-15687: chown_one() can dereference symlinks Package: src:systemd; Maintainer for src:systemd is Debian systemd Maintainers <pkg-systemd-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 27 Oct 2018 07:57:02 UTC Sev ...

Debian Bug report logs - #912008 systemd: CVE-2018-15688: Out-of-bounds heap write in systemd-networkd dhcpv6 option handling Package: src:systemd; Maintainer for src:systemd is Debian systemd Maintainers <pkg-systemd-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat ...

USN-3816-1 caused a regression in systemd-tmpfiles ...

systemd-tmpfiles could be made to change ownership of arbitrary files ...

Several security issues were fixed in systemd ...

A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files Affected releases are systemd versions up to and including 239 ...

A security issue has been found in systemd up to and including 239, where a race condition in the chown_one() function can be used to escalate privileges via a crafted symlink ...

[I am sending this bug report to Ubuntu, even though it's an upstream bug, as requested at githubcom/systemd/systemd/blob/master/docs/CONTRIBUTINGmd#security-vulnerability-reports ] When chown_one() in the recursive chown logic decides that it has to change ownership of a directory entry, it first changes ownership as follows: ...

Linux suffers from an issue with systemd where chown_one() can dereference symlinks ...

CWE-362 https://github.com/systemd/systemd/pull/10517/commits http://www.securityfocus.com/bid/105748 https://www.exploit-db.com/exploits/45715/https://security.gentoo.org/glsa/201810-10 https://usn.ubuntu.com/3816-1/https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=912007 https://usn.ubuntu.com/3816-3/https://www.exploit-db.com/exploits/45715/

CVE-2018-15687

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect