# CVE-2016-10156: systemd privilege escalation via world-writable SUID files in timers

Source: https://junglewise.ai/threats/cve-2016-10156-systemd-privilege-escalation-via-world-writable-suid-files-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-23. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-10156 · Severity: high · CVSS 7.8 · Published 2017-01-23

A vulnerability in systemd, a core component of many Linux operating systems, allows a local user to gain full administrative (root) control over the system. The issue occurs because certain system files are created with incorrect security permissions, making them world-writable while retaining elevated execution rights. An attacker with basic access to the system can replace these files with malicious code to take over the entire machine.

Technologies: [Systemd Project Systemd](https://junglewise.ai/threats/technologies/systemd). Vendors: [Systemd Project](https://junglewise.ai/threats/vendors/systemd-project).

## Quick answers

**Is CVE-2016-10156 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-10156 being exploited in the wild.

**How severe is CVE-2016-10156?** High severity, with a CVSS score of 7.8, published 23 January 2017.

**Which products and versions are affected?** systemd project systemd 228.

**Is there a fix for CVE-2016-10156?** A patch was published on 2016-01-29: Fixed upstream in commit 06eeacb6fe029804f296b065b3ce91e796e1cd0e Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-10156 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2016-10156?** Check whether you run Systemd Project Systemd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A logic error in the touch_file() function within src/basic/fs-util.c leads to files being created with mode 07777 when an invalid mode is passed. Because mode_t is an unsigned type, the check 'mode > 0' failed to correctly handle the MODE_INVALID constant (defined as -1), resulting in the creation of world-writable files with the SUID bit set. This is particularly exploitable via systemd timer 'stamp' files located in /var/lib/systemd/timers/. A local attacker can overwrite these SUID files with malicious binaries and execute them to gain root privileges. The issue was fixed in systemd v229 by explicitly checking for MODE_INVALID.

## Affected products

- systemd project systemd 228

## Timeline

- 2015-11-11: other: Vulnerability introduced in commit ee735086f8670be1591fa9593e80dd60163a7a2f
- 2016-01-29: patched: Fixed upstream in commit 06eeacb6fe029804f296b065b3ce91e796e1cd0e
- 2017-01-23: advisory: NVD publication date
- 2017-01-24: other: Public disclosure and exploit release by Sebastian Krahmer

## References

- [http://www.securityfocus.com/bid/95790](http://www.securityfocus.com/bid/95790)
- [http://www.securitytracker.com/id/1037686](http://www.securitytracker.com/id/1037686)
- [https://bugzilla.suse.com/show_bug.cgi?id=1020601](https://bugzilla.suse.com/show_bug.cgi?id=1020601)
- [https://github.com/systemd/systemd/commit/06eeacb6fe029804f296b065b3ce91e796e1cd0e](https://github.com/systemd/systemd/commit/06eeacb6fe029804f296b065b3ce91e796e1cd0e)
- [https://github.com/systemd/systemd/commit/ee735086f8670be1591fa9593e80dd60163a7a2f](https://github.com/systemd/systemd/commit/ee735086f8670be1591fa9593e80dd60163a7a2f)
- [https://www.exploit-db.com/exploits/41171/](https://www.exploit-db.com/exploits/41171/)

## Related threats

- [systemd systemd-journald ANSI escape sequence injection in wall messages](https://junglewise.ai/threats/cve-2026-40228-systemd-systemd-journald-ansi-escape-sequence-injection-in-wall)
- [systemd denial of service via malformed IPC API call](https://junglewise.ai/threats/cve-2026-40227-systemd-denial-of-service-via-malformed-ipc-api-call)
- [systemd systemd-machined local privilege escalation via Varlink](https://junglewise.ai/threats/cve-2026-40224-systemd-systemd-machined-local-privilege-escalation-via-varlink)
- [systemd denial of service via assertion failure in system units](https://junglewise.ai/threats/cve-2026-40223-systemd-denial-of-service-via-assertion-failure-in-system-units)