#VU5366 Privilege escalation in systemd - CVE-2016-10156

Vulnerability identifier: #VU5366

Vulnerability risk: Medium

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green

CVE-ID: CVE-2016-10156

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: Public exploit is available

Vulnerable software:
systemd

Software vendor:
Freedesktop.org

The vulnerability allows a local user to obtain root privileges.

The vulnerability exists within the touch_file() function in "/src/basic/fs-util.c". A local user can use systemd timer functions to create world writable set user id (suid) files, owned by root user, and gain root privileges on vulnerable system.

Successful exploitation of the vulnerability may allow a local user to gain root privileges on vulnerable system.

The vulnerability was fixed in version v229.

• https://bugzilla.suse.com/show_bug.cgi?id=1020601
• https://github.com/systemd/systemd/commit/06eeacb6fe029804f296b065b3ce91e796e1cd0e
• https://github.com/systemd/systemd/commit/ee735086f8670be1591fa9593e80dd60163a7a2f