CVE-2017-18188: Medium severity openr opentmpfiles vulnerability
Published Feb 14, 2018
·Updated
OpenRC opentmpfiles through 0.1.3, when the fs.protectedhardlinks sysctl is turned off, allows local users to obtain ownership of arbitrary files by creating a hard link inside a directory on which "chown -R" will be run.
Affected Software
1 affected component
OpenR opentmpfiles<=0.1.3
Event History
Feb 14, 2018
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-18188?
CVE-2017-18188 is considered a moderate severity vulnerability as it allows local users to potentially take ownership of arbitrary files.
2
How do I fix CVE-2017-18188?
To mitigate CVE-2017-18188, ensure that the fs.protected_hardlinks sysctl setting is enabled.
3
Which versions of OpenRC opentmpfiles are affected by CVE-2017-18188?
CVE-2017-18188 affects OpenRC opentmpfiles versions up to and including 0.1.3.
4
Can remote users exploit CVE-2017-18188?
No, CVE-2017-18188 can only be exploited by local users with access to the system.
5
What actions can be taken to secure a system affected by CVE-2017-18188?
In addition to enabling fs.protected_hardlinks, regularly update OpenRC opentmpfiles to ensure any security patches are applied.