Title: systemd-tmpfiles root privilege escalation through hard links
Author: Michael Orlitzky
Fixed in: Commit 5579f85; systemd 237
Summary
Before systemd 237, systemd-tmpfiles could change ownership or permissions on hard-linked files. On systems where protected hard links were disabled or ineffective, an attacker could hard-link a sensitive file into a path processed by a tmpfiles rule and gain control of it.
Learn more
Michael Orlitzky’s detailed advisory provides the full technical disclosure and remediation references for CVE-2017-18078.
What is CVE?
Common Vulnerabilities and Exposures (CVE) provides standard public identifiers for known cybersecurity vulnerabilities. MITRE maintains the CVE program and coordinates its vulnerability-identification ecosystem in the public interest.
About Metro Data, Inc.
Founded in 1994, Metro Data, Inc. is an information-systems and services firm that works exclusively with business clients to develop and apply technology solutions aligned with client goals.
Metro Data’s end-to-end experience helps customers keep pace with changing technology, secure systems, reduce costs, and improve information-system performance.
About the CVE author, Michael J. Orlitzky
Michael J. Orlitzky is a long-time Metro Data technical leader with a Ph.D. in mathematics who has discovered and helped remediate vulnerabilities in operating systems and application software, with research recognized by industry and academic peers.