It has been discovered that systemd-tmpfiles mishandles symbolic links present in non-terminal path components. In some configurations a local user could use this vulnerability to get access to arbitrary files when the systemd-tmpfiles command is run.
systemd-tmpfiles in systemd through version 237 mishandles symlinks present in non-terminal path components, allowing local users to obtain ownership of arbitrary files under certain configurations.
Depending on the configuration and access to files in /etc/tmpfiles.d, a local user can potentially create a symlink allowing them obtain full access to arbitrary files when the systemd-tmpfiles command is run.
This occurs even if the fs.protected_symlinks sysctl is turned on.
Created systemd tracking bugs for this issue:
Affects: fedora-all [bug 1545018]
Attack Complexity (AC) set to High (H) because the attacker cannot perform the attack as will, but particular configuration files have to be already configured and be owned/accessible by the attacker. Moreover, the attacker needs to find the right timing to perform the attack, so that the symlink replacement is performed when the tmpfiles configuration files are parsed.
Availability (A) set to High (H) because the attacker may be able to obtain ownership of files not originally owned by him and delete them or gain complete access to the system through changes to those files.