CVE-2018-6954

Published: 13 February 2018

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on.

Priority

CVSS 3 base score: 7.8

Status

Package	Release	Status
systemd Launchpad, Ubuntu, Debian	Upstream	Needs triage



	Ubuntu 18.04 LTS (Bionic Beaver)	Released (237-3ubuntu10.9)
	Ubuntu 16.04 LTS (Xenial Xerus)	Released (229-4ubuntu21.15)
	Ubuntu 14.04 ESM (Trusty Tahr)	Not vulnerable (binary not built)
	Patches: Upstream: https://github.com/systemd/systemd/pull/8358 Upstream: https://github.com/systemd/systemd/pull/8822 Upstream: https://github.com/systemd/systemd/commit/936f6bdb803c432578e2cdcc5f93f3bfff93aff0

Notes

Author	Note
mdeslaur	original fix was incomplete, see second pull
chrisccoulson	Fix reverted in xenial because it breaks containers running on pre-2.6.39 kernels
mdeslaur	fix was re-introduced in xenial in 229-4ubuntu21.15

References

Bugs

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM