CVE-2018-15686

Advisory lineage Upstream: 0 Downstream: 15
Modified
Published: 26 Oct 2018, 14:00
Last modified:09 Jun 2025, 15:50

Vulnerability Summary

Overall Risk (default)
medium
42/100
CVSS Score
7.8 HIGH
v3.1 (nvd)
EPSS Score
1.53% LOW
2% probability +0.40%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

26 Oct 2018, 14:00
Published
Vulnerability first disclosed
09 Jun 2025, 15:50
Last Modified
Vulnerability information updated

Description

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.

CVSS Metrics

  • v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • v3.0•HIGH•Score: 7CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 7.2AV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 1.53%• Percentile: 82%

Techniques & Countermeasures

  • CWE-502•Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Systems

  • canonical•ubuntu_linux

    16.04 | 18.04 | 18.10

  • debian•debian_linux

    8.0

  • oracle•communications_cloud_native_core_network_function_cloud_native_environment

    1.4.0

  • systemd_project•systemd

    ≤ 239

  • systemd•systemd

    ≥ unspecified, ≤ 239

References (11)