Arch Linux Security Advisory ASA-201811-11 ========================================== Severity: Critical Date : 2018-11-07 CVE-ID : CVE-2018-15686 CVE-2018-15687 CVE-2018-15688 Package : systemd Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-789 Summary ======= The package systemd before version 239.300-1 is vulnerable to multiple issues including arbitrary code execution and privilege escalation. Resolution ========== Upgrade to 239.300-1. # pacman -Syu "systemd>=239.300-1" The problems have been fixed upstream in version 239.300. Workaround ========== - CVE-2018-15688 Disable IPv6 by setting either LinkLocalAddressing=ipv4 or LinkLocalAddressing=no in the corresponding network configuration file. Description =========== - CVE-2018-15686 (privilege escalation) A security issue has been found in systemd up to and including 239, where the use of fgets() allows an attacker to escalate privilege via a crafted service with NotifyAccess. - CVE-2018-15687 (privilege escalation) A security issue has been found in systemd up to and including 239, where a race condition in the chown_one() function can be used to escalate privileges via a crafted symlink. - CVE-2018-15688 (arbitrary code execution) An out-of-bounds write has been found in the dhcpv6 option handing code of systemd-networkd up to and including v239. It was discovered that systemd-network does not correctly keep track of a buffer size in the dhcp6_option_append_ia() function, when constructing DHCPv6 packets. This flaw may lead to an integer underflow that can be used to produce an heap-based buffer overflow. A malicious host on the same network segment as the victim's one may advertise itself as a DHCPv6 server and exploit this flaw to cause a Denial of Service or potentially gain code execution on the victim's machine. The overflow can be triggered relatively easy by advertising a DHCPv6 server with a server-id >= 493 characters long. Impact ====== A remote attacker is able to cause arbitrary code execution by advertising itself as a DHCPv6 server with a specially crafted server- id. A local attacker can escalate privileges with a specially crafted service or a crafted symlink. References ========== https://bugs.archlinux.org/task/60609 https://bugs.chromium.org/p/project-zero/issues/detail?id=1687 https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1796402 https://github.com/systemd/systemd/pull/10447 https://github.com/systemd/systemd/pull/10450 https://bugs.chromium.org/p/project-zero/issues/detail?id=1689 https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1796692 https://github.com/systemd/systemd/pull/10517 https://bugs.launchpad.net/ubuntu/%2Bsource/systemd/%2Bbug/1795921 https://github.com/systemd/systemd/pull/10518 https://github.com/poettering/systemd/commit/49653743f69658aeeebdb14faf1ab15... https://security.archlinux.org/CVE-2018-15686 https://security.archlinux.org/CVE-2018-15687 https://security.archlinux.org/CVE-2018-15688