CVE-2018-15687

systemd: chown_one() can dereference symlinks

High · published October 26, 2018

CVSS v3.0
7.8
EPSS
1%
Percentile
64.2
In the wild
Unconfirmed
What it is

A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239.

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01058 · 64.2th percentile
Published
2018-10-26T14:00Z
EPSS history
Timeline
  • 26 OCT 14:00Z
    systemd: chown_one() can dereference symlinks
    cvelistv5