CVE-2018-16888: Medium severity Systemd Project Systemd vulnerability
It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.
Other sources
systemd up to version 237 does not perform any check on the content of the PIDFile file of a service, which may result in systemd killing a process owned by other services when the service the PIDFile belongs to is stopped. In case the PIDFile is owned by unprivileged users (e.g. a service run with a different User field), systemd may kill privileged processes. A local attacker who is able to tamper with the PIDFile of a service may trick systemd into killing processes he would not have permissions to kill, in the moment a privileged user tries to kill the mentioned service.
Upstream patches: https://github.com/systemd/systemd/pull/7816
Upstream issue: https://github.com/systemd/systemd/issues/6632
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2018-16888.
What is the severity of CVE-2018-16888?
CVE-2018-16888 has a severity rating of 4.7, which is considered medium.
Which software vendors are affected by CVE-2018-16888?
CVE-2018-16888 affects Redhat, Canonical, and Netapp.
How can I fix CVE-2018-16888?
To fix CVE-2018-16888, you should update your systemd package to version 237 or higher.
Where can I find more information about CVE-2018-16888?
You can find more information about CVE-2018-16888 on the MITRE, Ubuntu, and NIST websites.