systemd 228 Had A Local Root Exploit

Just in case any of you are running a slightly older Linux system that is still running systemd 228, it turns out there was a local root exploit in that version.

Systemd 228 shipped at the end of 2015 with a variety of changes but accidentally it also had a trivial systemd local root exploit. The issue ended up being silently fixed in January of last year. The fix in Git referenced it as just a potential denial of service when it turns out to have been a local root exploit.

When using systemd timers on v228, world writable suid files would be created. From there with these world-writable suid files, local attackers could dump binaries into these created files and execute as root.

This issue was pointed out last week in this SUSE bug report and today hit the oss-security list. This issue is marked as CVE-2016-10156. The issue was fixed in systemd 229, so just make sure your systems are not running v228.