CVE-2017-18078
Fixed in a distro release EPSS 1%
systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.
Products: systemd_project systemd, debian_linux, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | systemd | 237.0-1 |
| Chainguard | py3-systemd | 0 |
| Chainguard | py3.10-systemd | 0 |
| Chainguard | py3.11-systemd | 0 |
| Chainguard | py3.12-systemd | 0 |
| Chainguard | py3.13-systemd | 0 |
| Debian 12 | systemd | 237-1 |
| Debian 13 | systemd | 237-1 |
| Debian 14 | systemd | 237-1 |
| Debian 8 | systemd | 215-17+deb8u12 |
| SUSE Linux Enterprise Desktop 12 SP2 | systemd | 228-150.32.1 |
| SUSE Linux Enterprise Desktop 12 SP3 | systemd | 228-150.32.1 |
| SUSE Linux Enterprise Server 12 SP2 | systemd | 228-150.32.1 |
| SUSE Linux Enterprise Server 12 SP3 | systemd | 228-150.32.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | systemd | 228-150.32.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | systemd | 228-150.32.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | systemd | 228-150.32.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | systemd | 228-150.32.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | systemd | 228-150.32.1 |
| Ubuntu Pro 14.04 LTS | systemd | no fix |
| Ubuntu Pro 16.04 LTS | systemd | no fix |
| openSUSE Tumbleweed | systemd | 249.4-2.2 |