CVE-2016-10156 Information

Description

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features allowing local attackers to escalate their privileges to root. This is fixed in v229.

CVSS Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Reference

http://www.securityfocus.com/bid/95790 http://www.securitytracker.com/id/1037686 https://bugzilla.suse.com/show_bug.cgi?id=1020601 https://github.com/systemd/systemd/commit/06eeacb6fe029804f296b065b3ce91e796e1cd0e https://github.com/systemd/systemd/commit/ee735086f8670be1591fa9593e80dd60163a7a2f https://www.exploit-db.com/exploits/41171/

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

7.8