CVE-2017-18078

HIGH

systemd < 237 - Local Privilege Escalation via Hard Link Ownership Bypass

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-18078. PoCs published by Michael Orlitzky.

AI-analyzed exploit summary This is a detailed writeup explaining CVE-2017-18078, a vulnerability in systemd-tmpfiles where hard links can be exploited to change ownership and permissions of sensitive files if fs.protected_hardlinks is disabled. The document describes the attack scenario, proof-of-concept steps, and mitigation strategies.

Description

systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.

Exploits (1)

exploitdb WRITEUP

by Michael Orlitzky · textlocallinux

https://www.exploit-db.com/exploits/43935

View Code ZIP pw:eip

This is a detailed writeup explaining CVE-2017-18078, a vulnerability in systemd-tmpfiles where hard links can be exploited to change ownership and permissions of sensitive files if fs.protected_hardlinks is disabled. The document describes the attack scenario, proof-of-concept steps, and mitigation strategies.

Classification

Writeup 100%

Attack Type

Other

Complexity

Moderate

Reliability

Reliable

Target: systemd (systemd-tmpfiles) versions 236 and earlier

No auth needed

Prerequisites: fs.protected_hardlinks sysctl disabled · ability to create hard links on the target filesystem

MITRE ATT&CK