CVE-2018-15686: systemd: reexec state injection: fgets() on overlong lines leads to line splitting
A vulnerability in unitdeserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.
Other sources
systemd is vulnerable to line splitting via long lines read by fgets() in the unitdeserialize() function during daemon-reexec (e.g. during a package upgrade) allowing for state injection. Systemd services with NotifyAccess != none and malicious executables can exploit this vulnerability resulting corrupted process state.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-15686?
The severity of CVE-2018-15686 is high.
What is the vulnerability description of CVE-2018-15686?
CVE-2018-15686 is a vulnerability in unit_deserialize of systemd that allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess, possibly leading to root privilege escalation.
Which releases of systemd are affected by CVE-2018-15686?
Affected releases are systemd versions up to and including 229-4ubuntu21.8, 237-3ubuntu10.6, 239-7ubuntu10.3, and all versions listed for Debian.
How can I fix CVE-2018-15686?
To fix CVE-2018-15686, you should update systemd to version 229-4ubuntu21.9 or later for Ubuntu, and follow the recommended updates for Debian.
Where can I find more information about CVE-2018-15686?
You can find more information about CVE-2018-15686 on the MITRE CVE website, Ubuntu Security Notices, and NIST National Vulnerability Database.