CVE-2018-6954
Fixed in a distro release EPSS <1%CVSS 7.8
systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on.
Products: systemd_project systemd, canonical ubuntu_linux, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | systemd | 240.0-3 |
| Chainguard | py3-systemd | 0 |
| Chainguard | py3.10-systemd | 0 |
| Chainguard | py3.11-systemd | 0 |
| Chainguard | py3.12-systemd | 0 |
| Chainguard | py3.13-systemd | 0 |
| Debian 12 | systemd | 238-1 |
| Debian 13 | systemd | 238-1 |
| Debian 14 | systemd | 238-1 |
| SUSE Enterprise Storage 4 | systemd | 228-150.66.4 |
| SUSE Linux Enterprise Desktop 12 SP3 | systemd | 228-150.66.4 |
| SUSE Linux Enterprise Desktop 12 SP4 | systemd | 228-150.66.4 |
| SUSE Linux Enterprise Module for Basesystem 15 | systemd | 234-24.20.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | systemd | 228-150.66.4 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | systemd | 228-150.66.4 |
| SUSE Linux Enterprise Server 12 SP3 | systemd | 228-150.66.4 |
| SUSE Linux Enterprise Server 12 SP4 | systemd | 228-150.66.4 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | systemd | 228-150.66.4 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | systemd | 228-150.66.4 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | systemd | 228-150.66.4 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | systemd | 228-150.66.4 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | systemd | 228-150.66.4 |
| SUSE OpenStack Cloud 7 | systemd | 228-150.66.4 |
| Ubuntu 16.04 LTS | systemd | 229-4ubuntu21.15 |
| Ubuntu 16.04 LTS | systemd | 229-4ubuntu21.9 |
| Ubuntu 16.04 LTS | systemd | 229-4ubuntu21.8 |
| Ubuntu 18.04 LTS | systemd | 237-3ubuntu10.9 |
| Ubuntu 18.04 LTS | systemd | 237-3ubuntu10.6 |
| openSUSE Leap 15.0 | systemd | 234-lp150.20.12.1 |
| openSUSE Leap 15.0 | systemd-mini | 234-lp150.20.12.1 |
| openSUSE Tumbleweed | systemd | 249.4-2.2 |