CVE-2018-15686: systemd: reexec state injection: fgets() on overlong lines leads to line splitting
A vulnerability in unitdeserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.
Other sources
systemd is vulnerable to line splitting via long lines read by fgets() in the unitdeserialize() function during daemon-reexec (e.g. during a package upgrade) allowing for state injection. Systemd services with NotifyAccess != none and malicious executables can exploit this vulnerability resulting corrupted process state.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/systemdto a version that resolves this vulnerability.Fixed in 247.3-7+deb11u5Fixed in 247.3-7+deb11u6Fixed in 252.30-1~deb12u2Fixed in 256.6-1Fixed in 256.7-1
Event History
Frequently Asked Questions
What is the severity of CVE-2018-15686?
The severity of CVE-2018-15686 is high.
What is the vulnerability description of CVE-2018-15686?
CVE-2018-15686 is a vulnerability in unit_deserialize of systemd that allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess, possibly leading to root privilege escalation.
Which releases of systemd are affected by CVE-2018-15686?
Affected releases are systemd versions up to and including 229-4ubuntu21.8, 237-3ubuntu10.6, 239-7ubuntu10.3, and all versions listed for Debian.
How can I fix CVE-2018-15686?
To fix CVE-2018-15686, you should update systemd to version 229-4ubuntu21.9 or later for Ubuntu, and follow the recommended updates for Debian.
Where can I find more information about CVE-2018-15686?
You can find more information about CVE-2018-15686 on the MITRE CVE website, Ubuntu Security Notices, and NIST National Vulnerability Database.