p PatchFirst

CVE-2018-16888

CVE-2018-16888

This page contains facts from public vulnerability sources. Check the original advisory before updating.

It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.

CVSS 4.4 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • systemd

    Versions
    • v237: Affected

    No fix published

  • systemd Debian:12

    Affected ranges
    • ECOSYSTEM: < 237-1

    Update to 237-1

  • systemd Debian:13

    Affected ranges
    • ECOSYSTEM: < 237-1

    Update to 237-1

  • systemd Debian:14

    Affected ranges
    • ECOSYSTEM: < 237-1

    Update to 237-1

  • systemd Ubuntu:16.04:LTS

    Versions
    • 225-1ubuntu9
    • 227-2ubuntu1
    • 227-2ubuntu2
    • 228-1ubuntu2
    • 228-2ubuntu1
    • 228-2ubuntu2
    • 228-3ubuntu1
    • 228-4ubuntu1
    • 228-4ubuntu2
    • 228-5ubuntu1
    • 228-5ubuntu2
    • 228-5ubuntu3
    • 228-6ubuntu1
    • 229-1ubuntu2
    • 229-1ubuntu4
    • 229-2ubuntu1
    • 229-3ubuntu1
    • 229-3ubuntu2
    • 229-4ubuntu1
    • 229-4ubuntu4
    • 229-4ubuntu5
    • 229-4ubuntu6
    • 229-4ubuntu7
    • 229-4ubuntu8
    • 229-4ubuntu10
    • 229-4ubuntu11
    • 229-4ubuntu12
    • 229-4ubuntu13
    • 229-4ubuntu16
    • 229-4ubuntu17
    • 229-4ubuntu19
    • 229-4ubuntu20
    • 229-4ubuntu21
    • 229-4ubuntu21.1
    • 229-4ubuntu21.2
    • 229-4ubuntu21.3
    • 229-4ubuntu21.4
    • 229-4ubuntu21.5
    • 229-4ubuntu21.6
    • 229-4ubuntu21.8
    • 229-4ubuntu21.9
    • 229-4ubuntu21.10
    • 229-4ubuntu21.15
    • 229-4ubuntu21.16
    • 229-4ubuntu21.17
    • 229-4ubuntu21.19
    • 229-4ubuntu21.21
    • 229-4ubuntu21.22
    • 229-4ubuntu21.23
    Affected ranges
    • ECOSYSTEM: < 229-4ubuntu21.27

    Update to 229-4ubuntu21.27

Original sources

Check your server →