CVE-2018-15687

systemd: chown_one() can dereference symlinks

A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239.

Affected

systemd

CVSS v3.1 NVD

7.0 HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0 UBUNTU

7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.9 MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C

EPSS

1.06% chance of exploitation in the next 30 days, 64th percentile

Published

2018-10-26

Updated

2025-06-09

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/45715

Security advisories

• http://www.securityfocus.com/bid/105748
• systemd/systemd/pull/10517/commits
• https://security.gentoo.org/glsa/201810-10
• https://usn.ubuntu.com/3816-1

References

• CVE Record
• NVD entry