Bug 1545017 (CVE-2018-6954)
| Summary: | CVE-2018-6954 systemd: Mishandled symlinks in systemd-tmpfiles allows local users to obtain ownership of arbitrary files | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Sam Fowler <sfowler> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | cshabazi, lnykryn, msekleta, nkim, security-response-team, s, systemd-maint-list, systemd-maint, zbyszek |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
It has been discovered that systemd-tmpfiles mishandles symbolic links present in non-terminal path components. In some configurations a local user could use this vulnerability to get access to arbitrary files when the systemd-tmpfiles command is run.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-10-21 19:54:30 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1545018, 1545019, 1573211 | ||
| Bug Blocks: | 1552047 | ||
|
Description
Sam Fowler
2018-02-14 04:31:46 UTC
Created systemd tracking bugs for this issue: Affects: fedora-all [bug 1545018] Attack Complexity (AC) set to High (H) because the attacker cannot perform the attack as will, but particular configuration files have to be already configured and be owned/accessible by the attacker. Moreover, the attacker needs to find the right timing to perform the attack, so that the symlink replacement is performed when the tmpfiles configuration files are parsed. Availability (A) set to High (H) because the attacker may be able to obtain ownership of files not originally owned by him and delete them or gain complete access to the system through changes to those files. Mitigation: There is no known mitigation available. Statement: This flaw affects in particular those systems where custom tmpfiles files are configured (e.g. in /etc/tmpfiles.d). Indeed systemd-tmpfiles installed by system packages set privileges of a directory either to root or to a service specific user and not to interactive users. Even in case they provide one of the vulnerable tmpfiles configuration file (e.g. recursive "Z" type entries), an attacker would still need to perform the attack as the service specific user, which means they would first need to compromise that service. Moreover, systemd-tmpfiles service is automatically executed only when the system boots, when it is very unlikely an attacker has already a chance to perform any action at all. Otherwise, an attacker would have to wait for an administrator to manually run the `systemd-tmpfiles --create` command. |