CVE-2018-15687
systemd: chown_one() can dereference symlinks
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239.
Una condición de carrera en chown_one() en systemd permite que un atacante provoque que systemd establezca permisos arbitrarios en archivos arbitrarios. Las versiones afectadas de systemd son todas hasta la 239 incluida.
USN-3816-1 fixed several vulnerabilities in systemd. However, the fix for CVE-2018-6954 was not sufficient. This update provides the remaining fixes. Jann Horn discovered that unit_deserialize incorrectly handled status messages above a certain length. A local attacker could potentially exploit this via NotifyAccess to inject arbitrary state across re-execution and obtain root privileges. Jann Horn discovered a race condition in chown_one. A local attacker could potentially exploit this by setting arbitrary permissions on certain files to obtain root privileges. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. It was discovered that systemd-tmpfiles mishandled symlinks in non-terminal path components. A local attacker could potentially exploit this by gaining ownership of certain files to obtain root privileges. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2018-08-22 CVE Reserved
- 2018-10-26 CVE Published
- 2018-10-26 First Exploit
- 2025-03-30 EPSS Updated
- 2025-06-09 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CAPEC
References (6)
URL | Tag | Source |
---|---|---|
http://www.securityfocus.com/bid/105748 | Broken Link |
URL | Date | SRC |
---|---|---|
https://packetstorm.news/files/id/149973 | 2018-10-26 | |
https://www.exploit-db.com/exploits/45715 | 2025-06-09 |
URL | Date | SRC |
---|---|---|
https://github.com/systemd/systemd/pull/10517/commits | 2023-04-20 |
URL | Date | SRC |
---|---|---|
https://security.gentoo.org/glsa/201810-10 | 2023-04-20 | |
https://usn.ubuntu.com/3816-1 | 2023-04-20 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04" | lts |
Affected
| ||||||
Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.04" | lts |
Affected
| ||||||
Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.10" | - |
Affected
| ||||||
Systemd Project Search vendor "Systemd Project" | Systemd Search vendor "Systemd Project" for product "Systemd" | >= 235 < 240 Search vendor "Systemd Project" for product "Systemd" and version " >= 235 < 240" | - |
Affected
|