CVE-2018-6954

It has been discovered that systemd-tmpfiles mishandles symbolic links present in non-terminal path components. In some configurations a local user could use this vulnerability to get access to arbitrary files when the systemd-tmpfiles command is run.

This flaw affects in particular those systems where custom tmpfiles files are configured (e.g. in /etc/tmpfiles.d). Indeed systemd-tmpfiles installed by system packages set privileges of a directory either to root or to a service specific user and not to interactive users. Even in case they provide one of the vulnerable tmpfiles configuration file (e.g. recursive "Z" type entries), an attacker would still need to perform the attack as the service specific user, which means they would first need to compromise that service.

Moreover, systemd-tmpfiles service is automatically executed only when the system boots, when it is very unlikely an attacker has already a chance to perform any action at all. Otherwise, an attacker would have to wait for an administrator to manually run the systemd-tmpfiles --create command.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There is no known mitigation available.