systemd 228 Had A Local Root Exploit
Written by Michael Larabel in systemd on 24 January 2017 at 05:26 AM EST. 72 Comments
SYSTEMD --
Just in case any of you are running a slightly older Linux system that is still running systemd 228, it turns out there was a local root exploit in that version.

Systemd 228 shipped at the end of 2015 with a variety of changes but accidentally it also had a trivial systemd local root exploit. The issue ended up being silently fixed in January of last year. The fix in Git referenced it as just a potential denial of service when it turns out to have been a local root exploit.

When using systemd timers on v228, world writable suid files would be created. From there with these world-writable suid files, local attackers could dump binaries into these created files and execute as root.

This issue was pointed out last week in this SUSE bug report and today hit the oss-security list. This issue is marked as CVE-2016-10156. The issue was fixed in systemd 229, so just make sure your systems are not running v228.
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 10,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Related systemd News
Popular News