CVE-2018-15686 systemd: reexec state injection: fgets() on overlong lines leads to line splitting
HighCVSS 7.8
EPSS 2.3%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/systemd(Debian:12) | < 239-12 | 239-12 |
| debian/systemd(Debian:13) | < 239-12 | 239-12 |
| debian/systemd(Debian:14) | < 239-12 | 239-12 |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.10 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| systemd project systemd | <= 239 | No fix listed |
| oracle communications cloud native core network function cloud native environment | = 1.4.0 | No fix listed |
| systemd | <= 239 | No fix listed |
References
- Debian Security Tracker CVE-2018-15686 vendor-advisory
- bugs.debian.org issue-tracking
- 105747 third-party-advisory vdb-entry
- RHSA-2019:2091 third-party-advisory vendor-advisory
- RHSA-2019:3222 third-party-advisory vendor-advisory
- RHSA-2020:0593 third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image mailing-list
- [debian-lts-announce] 20181119 [SECURITY] [DLA 1580-1] systemd security update mailing-list third-party-advisory
- GLSA-201810-10 third-party-advisory vendor-advisory
- USN-3816-1 third-party-advisory vendor-advisory
- 45714 exploit third-party-advisory vdb-entry
- www.oracle.com third-party-advisory