CVE-2018-15686

systemd: reexec state injection: fgets() on overlong lines leads to line splitting

High · published October 26, 2018

CVSS v3.0
7.0
EPSS
2%
Percentile
82.7
In the wild
Unconfirmed
What it is

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.

The record
Technical detail
CVSS v3.0
7.0 · HIGH
Vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02261 · 82.7th percentile
Published
2018-10-26T14:00Z
EPSS history
Timeline
  • 26 OCT 14:00Z
    systemd: reexec state injection: fgets() on overlong lines leads to line splitting
    cvelistv5