Summaryinfo

A vulnerability categorized as critical has been discovered in systemd up to 236. This vulnerability affects unknown code of the component systemd-tmpfiles. Such manipulation as part of Hard Link leads to access control. This vulnerability is referenced as CVE-2017-18078. The attack can only be performed from a local environment. Furthermore, an exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in systemd up to 236. Affected by this issue is an unknown functionality of the component systemd-tmpfiles. The manipulation as part of a Hard Link leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality, integrity, and availability. CVE summarizes:

systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.

The bug was discovered 01/28/2018. The weakness was published 01/29/2018 (Website). The advisory is available at github.com. This vulnerability is handled as CVE-2017-18078 since 01/28/2018. Local access is required to approach this attack. The successful exploitation needs a simple authentication. Technical details are unknown but a public exploit is available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 107050 (openSUSE Security Update : systemd (openSUSE-2018-216)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family SuSE Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 176866 (Debian Security Update for systemd (DLA 1762-1)).

Upgrading to version 237 eliminates this vulnerability. A possible mitigation has been published 2 months after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (43935) and Tenable (107050). Similar entry is available at VDB-133260. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• systemd

Version

• 236

License

• open-source

Website

• Product: https://github.com/systemd/systemd/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion