CVE-2018-15687

🗓️ 26 Oct 2018 14:00:00Reported by canonicalType

cve🔗 web.nvd.nist.gov👁 115 Views🌐 WEB

A race condition in chown_one() of systemd allows arbitrary file permission chang

Reporter	Title	Published	Views	Family All 52
zdt	Linux systemd Symlink Dereference Via chown_one() Exploit	26 Oct 201800:00	–	zdt
zdt	systemd - chown_one() can Dereference Symlinks Exploit	29 Oct 201800:00	–	zdt
IBM Security Bulletins	Security Bulletin: IBM API Connect has addressed multiple vulnerabilities in Developer Portal's dependencies - Cumulative list from June 28, 2018 to December 13, 2018	28 Jan 201917:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Cloud Paks are vulnerable to multiple vulnerabilities in Systemd (CVE-2018-15688 CVE-2018-15687 CVE-2018-15686)	18 Dec 201813:50	–	ibm
ALT Linux	Security fix for the ALT Linux 9 package systemd version 1:239-alt3	29 Oct 201800:00	–	altlinux
ArchLinux	[ASA-201811-11] systemd: multiple issues	7 Nov 201800:00	–	archlinux
BDU FSTEC	The vulnerability of the chown_one() function in the initialization subsystem and systemd service management allows a attacker to increase their privileges.	26 May 202200:00	–	bdu_fstec
CBLMariner	CVE-2018-15687 affecting package systemd 239-44	9 Sep 202006:09	–	cbl_mariner
Cloud Foundry	USN-3816-1: systemd vulnerabilities \| Cloud Foundry	20 Nov 201800:00	–	cloudfoundry
Cloud Foundry	USN-3816-3: systemd regression \| Cloud Foundry	6 Dec 201800:00	–	cloudfoundry

NVD

Node

canonical ubuntu_linuxMatch16.04lts

canonical ubuntu_linuxMatch18.04lts

canonical ubuntu_linuxMatch18.10

Node

systemd_project systemdRange235–240

[
  {
    "product": "systemd",
    "vendor": "systemd",
    "versions": [
      {
        "lessThanOrEqual": "239",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
securityfocus	www.securityfocus.com/bid/105748
exploit-db	www.exploit-db.com/exploits/45715/
security	www.security.gentoo.org/glsa/201810-10
github	www.github.com/systemd/systemd/pull/10517/commits
usn	www.usn.ubuntu.com/3816-1/

Parameter	Position	Path	Description	CWE
name	path	/var/lib/test_service	Directory entry processing in chown_one() race condition can cause unintended permission changes when ownership is changed for entries in a state directory.	CWE-362
name	path	/var/lib/test_service/foo	Race condition involving chownat/fchmodat flow on a named entry can follow symlinks and result in improper permission fixups.	CWE-362
name	path	/var/lib/test_service/foo2	Symlink-based entry involved in ownership change scenario can trigger permission fixups due to race in chown/chmod path handling.	CWE-362
name	path	/var/lib/test_service/foo_link	Symlink target involved in the ownership change logic can cause unintended permission changes when the service restarts.	CWE-362
name	path	/etc/hostname	Target file used in the reproduction to demonstrate permission changes via ownership fixups on linked paths.	CWE-362

17 Jun 2026 01:42Current

7.6High risk

Vulners AI Score7.6

CVSS 26.9

CVSS 3.17

CVSS 37.8

EPSS0.01058

SSVC

CWE-362