CVE-2017-18078 in systemd
Summary
by MITRE
systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/03/2024
The vulnerability identified as CVE-2017-18078 represents a critical access control bypass in systemd's tmpfiles.d functionality, specifically affecting systemd versions prior to 237. This flaw exists within the systemd-tmpfiles component which manages temporary files and directories according to configuration files in the tmpfiles.d directory. The vulnerability arises from the improper handling of hardlinked files during ownership and permission modifications, creating a pathway for local attackers to circumvent intended security restrictions.
The technical implementation of this vulnerability stems from systemd's failure to properly respect the fs.protected_hardlinks kernel sysctl setting when processing hardlinked files. When this sysctl is disabled, the system should allow operations that would normally be restricted on hardlinked files to prevent privilege escalation. However, systemd-tmpfiles continued to attempt ownership and permission changes on hardlinked files regardless of this kernel protection mechanism. This behavior creates a scenario where a local user can create a hard link to a sensitive system file such as /etc/passwd and then manipulate the permissions or ownership of the linked file, effectively bypassing the intended access controls.
The operational impact of this vulnerability is significant as it provides local attackers with a method to escalate privileges and modify critical system files without proper authorization. The demonstration involving /etc/passwd highlights the potential for attackers to gain unauthorized access to user account information and potentially establish persistent access to the system. This vulnerability aligns with CWE-284 Access Control Bypass and represents a failure in the principle of least privilege, where the system fails to properly enforce access restrictions on hardlinked files. The attack vector specifically targets the tmpfiles.d configuration mechanism, which is commonly used by system administrators to manage temporary file creation and access permissions, making the vulnerability particularly dangerous in environments where such configurations are prevalent.
The security implications extend beyond simple file access bypass as this vulnerability can be exploited to compromise the integrity and confidentiality of system data. Attackers can leverage this flaw to modify system configuration files, install backdoors, or manipulate authentication databases. The vulnerability also demonstrates a lack of proper kernel integration within the systemd component, as it should respect the kernel's security policies regarding hardlink operations. Mitigation efforts should include upgrading to systemd version 237 or later, where the proper handling of hardlinked files has been implemented. Additionally, system administrators should review tmpfiles.d configurations to ensure that sensitive files are not unnecessarily exposed to hardlink manipulation, and consider implementing additional monitoring for unauthorized changes to critical system files. This vulnerability highlights the importance of proper kernel security policy enforcement within userspace components and the need for comprehensive security testing of system management utilities. The ATT&CK framework categorizes this vulnerability under privilege escalation techniques, specifically targeting the T1068 Exploitation for Privilege Escalation tactic, where local users can leverage system component weaknesses to gain elevated privileges.