CVE-2018-15687

Description

A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239.

CVSS Metrics

• v3.1•HIGH•Score: 7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
• v3.0•HIGH•Score: 7.8CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• v2.0•MEDIUM•Score: 6.9AV:L/AC:M/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 0.38%• Percentile: 60%

Techniques & Countermeasures

• CWE-362•Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected Systems

• canonical•ubuntu_linux

  16.04 | 18.04 | 18.10

• systemd_project•systemd

  ≥ 235, < 240

• systemd•systemd

  ≥ unspecified, ≤ 239

References (5)

• https://security.gentoo.org/glsa/201810-10
• https://github.com/systemd/systemd/pull/10517/commits
• http://www.securityfocus.com/bid/105748
• https://usn.ubuntu.com/3816-1/
• https://www.exploit-db.com/exploits/45715/