Junglewise Threat Intelligence

CVE-2016-10156: systemd privilege escalation via world-writable SUID files in timers

CVE-2016-10156 · Severity: high · CVSS 7.8 · Published 2017-01-23

Technologies: Systemd Project Systemd. Vendors: Systemd Project.

Executive brief

A vulnerability in systemd, a core component of many Linux operating systems, allows a local user to gain full administrative (root) control over the system. The issue occurs because certain system files are created with incorrect security permissions, making them world-writable while retaining elevated execution rights. An attacker with basic access to the system can replace these files with malicious code to take over the entire machine.

Technical details

A logic error in the touch_file() function within src/basic/fs-util.c leads to files being created with mode 07777 when an invalid mode is passed. Because mode_t is an unsigned type, the check 'mode > 0' failed to correctly handle the MODE_INVALID constant (defined as -1), resulting in the creation of world-writable files with the SUID bit set. This is particularly exploitable via systemd timer 'stamp' files located in /var/lib/systemd/timers/. A local attacker can overwrite these SUID files with malicious binaries and execute them to gain root privileges. The issue was fixed in systemd v229 by explicitly checking for MODE_INVALID.

Affected products

  • systemd project systemd 228

Timeline

  • 2015-11-11: other: Vulnerability introduced in commit ee735086f8670be1591fa9593e80dd60163a7a2f
  • 2016-01-29: patched: Fixed upstream in commit 06eeacb6fe029804f296b065b3ce91e796e1cd0e
  • 2017-01-23: advisory: NVD publication date
  • 2017-01-24: other: Public disclosure and exploit release by Sebastian Krahmer

References

Related threats