Bug 1545017 (CVE-2018-6954) - CVE-2018-6954 systemd: Mishandled symlinks in systemd-tmpfiles allows local users to obtain ownership of arbitrary files
Summary: CVE-2018-6954 systemd: Mishandled symlinks in systemd-tmpfiles allows local u...
Alias: CVE-2018-6954
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1545018 Engineering1545019 Engineering1573211
Blocks: Embargoed1552047
TreeView+ depends on / blocked
Reported: 2018-02-14 04:31 UTC by Sam Fowler
Modified: 2021-10-21 19:54 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
It has been discovered that systemd-tmpfiles mishandles symbolic links present in non-terminal path components. In some configurations a local user could use this vulnerability to get access to arbitrary files when the systemd-tmpfiles command is run.
Clone Of:
Last Closed: 2021-10-21 19:54:30 UTC

Attachments (Terms of Use)

Description Sam Fowler 2018-02-14 04:31:46 UTC
systemd-tmpfiles in systemd through version 237 mishandles symlinks present in non-terminal path components, allowing local users to obtain ownership of arbitrary files under certain configurations.

Depending on the configuration and access to files in /etc/tmpfiles.d, a local user can potentially create a symlink allowing them obtain full access to arbitrary files when the systemd-tmpfiles command is run. 

This occurs even if the fs.protected_symlinks sysctl is turned on.

Upstream Issue:


Comment 1 Sam Fowler 2018-02-14 04:32:13 UTC
Created systemd tracking bugs for this issue:

Affects: fedora-all [bug 1545018]

Comment 7 Riccardo Schirone 2018-12-11 10:55:12 UTC
Attack Complexity (AC) set to High (H) because the attacker cannot perform the attack as will, but particular configuration files have to be already configured and be owned/accessible by the attacker. Moreover, the attacker needs to find the right timing to perform the attack, so that the symlink replacement is performed when the tmpfiles configuration files are parsed.

Availability (A) set to High (H) because the attacker may be able to obtain ownership of files not originally owned by him and delete them or gain complete access to the system through changes to those files.

Comment 12 Riccardo Schirone 2020-02-17 15:15:39 UTC

There is no known mitigation available.

Comment 13 Riccardo Schirone 2020-02-17 15:16:38 UTC

This flaw affects in particular those systems where custom tmpfiles files are configured (e.g. in /etc/tmpfiles.d). Indeed systemd-tmpfiles installed by system packages set privileges of a directory either to root or to a service specific user and not to interactive users. Even in case they provide one of the vulnerable tmpfiles configuration file (e.g. recursive "Z" type entries), an attacker would still need to perform the attack as the service specific user, which means they would first need to compromise that service.

Moreover, systemd-tmpfiles service is automatically executed only when the system boots, when it is very unlikely an attacker has already a chance to perform any action at all. Otherwise, an attacker would have to wait for an administrator to manually run the `systemd-tmpfiles --create` command.

Comment 14 Riccardo Schirone 2020-02-17 15:25:41 UTC

Note You need to log in before you can comment on or make changes to this bug.