8.8 High
CVSS3
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
0.003 Low
EPSS
Percentile
68.5%
Severity: Critical
Date : 2018-11-07
CVE-ID : CVE-2018-15686 CVE-2018-15687 CVE-2018-15688
Package : systemd
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-789
The package systemd before version 239.300-1 is vulnerable to multiple
issues including arbitrary code execution and privilege escalation.
Upgrade to 239.300-1.
The problems have been fixed upstream in version 239.300.
Disable IPv6 by setting either LinkLocalAddressing=ipv4 or
LinkLocalAddressing=no in the corresponding network configuration file.
A security issue has been found in systemd up to and including 239,
where the use of fgets() allows an attacker to escalate privilege via a
crafted service with NotifyAccess.
A security issue has been found in systemd up to and including 239,
where a race condition in the chown_one() function can be used to
escalate privileges via a crafted symlink.
An out-of-bounds write has been found in the dhcpv6 option handing code
of systemd-networkd up to and including v239.
It was discovered that systemd-network does not correctly keep track of
a buffer size in the dhcp6_option_append_ia() function, when
constructing DHCPv6 packets. This flaw may lead to an integer underflow
that can be used to produce an heap-based buffer overflow. A malicious
host on the same network segment as the victim’s one may advertise
itself as a DHCPv6 server and exploit this flaw to cause a Denial of
Service or potentially gain code execution on the victim’s machine. The
overflow can be triggered relatively easy by advertising a DHCPv6
server with a server-id >= 493 characters long.
A remote attacker is able to cause arbitrary code execution by
advertising itself as a DHCPv6 server with a specially crafted server-
id. A local attacker can escalate privileges with a specially crafted
service or a crafted symlink.
https://bugs.archlinux.org/task/60609
https://bugs.chromium.org/p/project-zero/issues/detail?id=1687
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1796402
https://github.com/systemd/systemd/pull/10447
https://github.com/systemd/systemd/pull/10450
https://bugs.chromium.org/p/project-zero/issues/detail?id=1689
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1796692
https://github.com/systemd/systemd/pull/10517
https://bugs.launchpad.net/ubuntu/%2Bsource/systemd/%2Bbug/1795921
https://github.com/systemd/systemd/pull/10518
https://github.com/poettering/systemd/commit/49653743f69658aeeebdb14faf1ab158f1f2cb20
https://security.archlinux.org/CVE-2018-15686
https://security.archlinux.org/CVE-2018-15687
https://security.archlinux.org/CVE-2018-15688
bugs.archlinux.org/task/60609
bugs.chromium.org/p/project-zero/issues/detail?id=1687
bugs.chromium.org/p/project-zero/issues/detail?id=1689
bugs.launchpad.net/ubuntu/%2Bsource/systemd/%2Bbug/1795921
bugs.launchpad.net/ubuntu/+source/systemd/+bug/1796402
bugs.launchpad.net/ubuntu/+source/systemd/+bug/1796692
github.com/poettering/systemd/commit/49653743f69658aeeebdb14faf1ab158f1f2cb20
github.com/systemd/systemd/pull/10447
github.com/systemd/systemd/pull/10450
github.com/systemd/systemd/pull/10517
github.com/systemd/systemd/pull/10518
security.archlinux.org/AVG-789
security.archlinux.org/CVE-2018-15686
security.archlinux.org/CVE-2018-15687
security.archlinux.org/CVE-2018-15688
8.8 High
CVSS3
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
0.003 Low
EPSS
Percentile
68.5%