Privilege escalation in systemd - CVE-2016-10156

Vulnerability identifier: #VU5366

CSH Severity: Medium

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-10156

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local user to obtain root privileges.

The vulnerability exists within the touch_file() function in "/src/basic/fs-util.c". A local user can use systemd timer functions to create world writable set user id (suid) files, owned by root user, and gain root privileges on vulnerable system.

Successful exploitation of the vulnerability may allow a local user to gain root privileges on vulnerable system.

systemd
SUSE Linux

The vulnerability was fixed in version v229.

• Exploit #907 - Systemd 228 (SUSE 12 SP2 / Ubuntu Touch 15.04) - Privilege Escalation (PoC) (March 18, 2020)

• https://bugzilla.suse.com/show_bug.cgi?id=1020601
• https://github.com/systemd/systemd/commit/06eeacb6fe029804f296b065b3ce91e796e1cd0e
• https://github.com/systemd/systemd/commit/ee735086f8670be1591fa9593e80dd60163a7a2f

• Privilege escalation in systemd
• OpenSUSE Linux update for systemd
• SUSE Linux update for systemd