Privilege Escalation Vulnerability in systemd-tmpfiles Affected by Ownership Issues
CVE-2017-18078

7.8HIGH

Key Information:

Vendor

Systemd Project

Status
Systemd
Vendor
CVE Published:
29 January 2018

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2017-18078?

A vulnerability in systemd-tmpfiles permits local users to breach access restrictions by manipulating file ownership and permissions, even when the fs.protected_hardlinks sysctl setting is disabled. This flaw can potentially allow users to change the ownership of critical system files, such as /etc/passwd, leading to serious security implications.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cortex9-tmpfiles-hardlink-chown-race-model
Created by federiconbaez

References

http://lists.opensuse.org/opensuse-updates/2018-02/msg001...
vendor-advisoryx_refsource_SUSE
http://www.openwall.com/lists/oss-security/2018/01/29/3
mailing-listx_refsource_MLIST
https://www.exploit-db.com/exploits/43935/
exploitx_refsource_EXPLOIT-DB

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.