Published: 13/02/2018 Updated: 07/11/2023

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 643

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on.

Vulnerable Product	Search on Vulmon	Subscribe to Product
systemd project systemd
canonical ubuntu linux 16.04
opensuse leap 42.3
canonical ubuntu linux 18.04
canonical ubuntu linux 18.10

Debian Bug report logs - #890779 systemd: CVE-2018-6954: Mishandled sysmlinks in systemd-tmpfiles allows local users to obtain ownership of arbitrary files Package: src:systemd; Maintainer for src:systemd is Debian systemd Maintainers <pkg-systemd-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <car ...

USN-3816-1 caused a regression in systemd-tmpfiles ...

systemd-tmpfiles could be made to change ownership of arbitrary files ...

Several security issues were fixed in systemd ...

It has been discovered that systemd-tmpfiles mishandles symbolic links present in non-terminal path components In some configurations a local user could use this vulnerability to get access to arbitrary files when the systemd-tmpfiles command is run ...

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink This occurs even if the fsprotected_symlinks sysctl is ...

CWE-59 https://github.com/systemd/systemd/issues/7986 https://usn.ubuntu.com/3816-1/https://usn.ubuntu.com/3816-2/http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.html https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=890779 https://nvd.nist.gov https://usn.ubuntu.com/3816-3/

CVE-2018-6954

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect