Is CVE-2016-10156 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-10156 being exploited in the wild.

How severe is CVE-2016-10156?

High severity, with a CVSS score of 7.8, published 23 January 2017.

Is there a fix for CVE-2016-10156?

A patch was published on 2016-01-29: Fixed upstream in commit 06eeacb6fe029804f296b065b3ce91e796e1cd0e Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-10156 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2016-10156?

Check whether you run Systemd Project Systemd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-10156: systemd privilege escalation via world-writable SUID files in timers

CVE-2016-10156 · Severity: high · CVSS 7.8 · Published 2017-01-23

A vulnerability in systemd, a core component of many Linux operating systems, allows a local user to gain full administrative (root) control over the system. The issue occurs because certain system files are created with incorrect security permissions, making them world-writable while retaining elevated execution rights. An attacker with basic access to the system can replace these files with malicious code to take over the entire machine.

Technologies: Systemd Project Systemd. Vendors: Systemd Project.

Quick answers

Is CVE-2016-10156 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-10156 being exploited in the wild.
How severe is CVE-2016-10156?: High severity, with a CVSS score of 7.8, published 23 January 2017.
Which products and versions are affected?: systemd project systemd 228.
Is there a fix for CVE-2016-10156?: A patch was published on 2016-01-29: Fixed upstream in commit 06eeacb6fe029804f296b065b3ce91e796e1cd0e Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-10156 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2016-10156?: Check whether you run Systemd Project Systemd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logic error in the touch_file() function within src/basic/fs-util.c leads to files being created with mode 07777 when an invalid mode is passed. Because mode_t is an unsigned type, the check 'mode > 0' failed to correctly handle the MODE_INVALID constant (defined as -1), resulting in the creation of world-writable files with the SUID bit set. This is particularly exploitable via systemd timer 'stamp' files located in /var/lib/systemd/timers/. A local attacker can overwrite these SUID files with malicious binaries and execute them to gain root privileges. The issue was fixed in systemd v229 by explicitly checking for MODE_INVALID.

Affected products

systemd project systemd 228

Timeline

2015-11-11: other: Vulnerability introduced in commit ee735086f8670be1591fa9593e80dd60163a7a2f
2016-01-29: patched: Fixed upstream in commit 06eeacb6fe029804f296b065b3ce91e796e1cd0e
2017-01-23: advisory: NVD publication date
2017-01-24: other: Public disclosure and exploit release by Sebastian Krahmer

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.