Bug 1545017 (CVE-2018-6954) - CVE-2018-6954 systemd: Mishandled symlinks in systemd-tmpfiles allows local users to obtain ownership of arbitrary files
Summary: CVE-2018-6954 systemd: Mishandled symlinks in systemd-tmpfiles allows local u...
Status: NEW
Alias: CVE-2018-6954
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20180125,repor...
Keywords: Security
Depends On: 1545018 1545019 1573211
Blocks: 1552047
TreeView+ depends on / blocked
 
Reported: 2018-02-14 04:31 UTC by Sam Fowler
Modified: 2019-06-08 22:41 UTC (History)
9 users (show)

(edit)
It has been discovered that systemd-tmpfiles mishandles symbolic links present in non-terminal path components. In some configurations a local user could use this vulnerability to get access to arbitrary files when the systemd-tmpfiles command is run.
Clone Of:
(edit)
Last Closed:


Attachments (Terms of Use)

Description Sam Fowler 2018-02-14 04:31:46 UTC
systemd-tmpfiles in systemd through version 237 mishandles symlinks present in non-terminal path components, allowing local users to obtain ownership of arbitrary files under certain configurations.

Depending on the configuration and access to files in /etc/tmpfiles.d, a local user can potentially create a symlink allowing them obtain full access to arbitrary files when the systemd-tmpfiles command is run. 

This occurs even if the fs.protected_symlinks sysctl is turned on.


Upstream Issue:

https://github.com/systemd/systemd/issues/7986

Comment 1 Sam Fowler 2018-02-14 04:32:13 UTC
Created systemd tracking bugs for this issue:

Affects: fedora-all [bug 1545018]

Comment 7 Riccardo Schirone 2018-12-11 10:55:12 UTC
Attack Complexity (AC) set to High (H) because the attacker cannot perform the attack as will, but particular configuration files have to be already configured and be owned/accessible by the attacker. Moreover, the attacker needs to find the right timing to perform the attack, so that the symlink replacement is performed when the tmpfiles configuration files are parsed.

Availability (A) set to High (H) because the attacker may be able to obtain ownership of files not originally owned by him and delete them or gain complete access to the system through changes to those files.


Note You need to log in before you can comment on or make changes to this bug.