High
Security advisory
systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-18078
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:50 UTC · Revision 1
Source evidence
systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.
osv:CVE-2017-18078
Complete source record
{
"id": "6d761e5ffa6ca8a90868f5010c618d57a26c314475866e00bb2d1853e48743c5",
"url": "https://osv.dev/vulnerability/CVE-2017-18078",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-18078",
"summary": "systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.",
"evidence": "osv:CVE-2017-18078",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2017-18078",
"aliases": [
"CVE-2017-18078"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/systemd/systemd",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "46659f7deb962f55c728e70597e37c2a3ab6326d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "237"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v236",
"v235",
"v234",
"v233",
"v232",
"v231",
"v230",
"v229",
"v228",
"v227",
"v226",
"v225",
"v224",
"v223",
"v222",
"v221",
"v219",
"v220",
"v218",
"v217",
"v216",
"v215",
"v214",
"v213",
"v212",
"v211",
"v210",
"v209",
"v208",
"v207",
"v206",
"v205",
"v204",
"v203",
"v202",
"v201",
"v200",
"v199",
"v198",
"v197",
"v196",
"v195",
"v194",
"v193",
"v192",
"v191",
"v190",
"v189",
"v188",
"v187",
"v186",
"v185",
"v184",
"v183",
"v44",
"v43",
"v42",
"v41",
"v40",
"v39",
"v38",
"v37",
"v36",
"v35",
"v34",
"v33",
"v32",
"v31",
"v30",
"v29",
"v28",
"v27",
"v26",
"v25",
"v24",
"v23",
"v22",
"v21",
"v20",
"v19",
"v18",
"v17",
"v16",
"v15",
"v14",
"v13",
"v12",
"v11",
"v10",
"v9",
"v8",
"v7",
"v6",
"v5",
"v4",
"v3",
"v2",
"v1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-18078.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/systemd/systemd-stable",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "46659f7deb962f55c728e70597e37c2a3ab6326d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "237"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v236",
"v235",
"v234",
"v233",
"v232",
"v231",
"v230",
"v229",
"v228",
"v227",
"v226",
"v225",
"v224",
"v223",
"v222",
"v221",
"v219",
"v220",
"v218",
"v217",
"v216",
"v215",
"v214",
"v213",
"v212",
"v211",
"v210",
"v208",
"v209",
"v201",
"v204",
"v207",
"v206",
"v205",
"v203",
"v202",
"v200",
"v199",
"v198",
"v197",
"v196",
"systemd-v196",
"v195",
"systemd-v195",
"v194",
"systemd-v194",
"v193",
"systemd-v193",
"v192",
"systemd-v192",
"v191",
"systemd-v191",
"v190",
"systemd-v190",
"v189",
"systemd-v189",
"v188",
"systemd-v188",
"v187",
"systemd-v187",
"v186",
"systemd-v186",
"v185",
"systemd-v185",
"v184",
"systemd-v184",
"v183",
"systemd-v183",
"v44",
"systemd-v44",
"v43",
"systemd-v43",
"v42",
"systemd-v42",
"v41",
"systemd-v41",
"v40",
"systemd-v40",
"v39",
"systemd-v39",
"v38",
"systemd-v38",
"v37",
"systemd-v37",
"v36",
"systemd-v36",
"v35",
"systemd-v35",
"v34",
"systemd-v34",
"v33",
"systemd-v33",
"v32",
"systemd-v32",
"v31",
"systemd-v31",
"v30",
"systemd-v30",
"v29",
"systemd-v29",
"v28",
"systemd-v28",
"v27",
"systemd-v27",
"v26",
"systemd-v26",
"v25",
"systemd-v25",
"v24",
"systemd-v24",
"v23",
"systemd-v23",
"v22",
"systemd-v22",
"v21",
"systemd-v21",
"v20",
"systemd-v20",
"v19",
"systemd-v19",
"v18",
"systemd-v18",
"v17",
"systemd-v17",
"v16",
"systemd-v16",
"v15",
"systemd-v15",
"v14",
"systemd-v14",
"v13",
"systemd-v13",
"v12",
"systemd-v12",
"v11",
"systemd-v11",
"v10",
"systemd-v10",
"v9",
"systemd-v9",
"v8",
"systemd-v8",
"v7",
"systemd-v7",
"v6",
"systemd-v6",
"v5",
"systemd-v5",
"v4",
"systemd-v4",
"v3",
"systemd-v3",
"v2",
"systemd-v2",
"v1",
"systemd-v1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-18078.json"
}
}
],
"modified": "2026-10-24T10:50:28.956319653Z",
"provider": "osv",
"references": [
"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E",
"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E",
"https://lists.debian.org/debian-lts-announce/2019/04/msg00022.html",
"https://www.openwall.com/lists/oss-security/2018/01/29/4",
"https://github.com/systemd/systemd/issues/7736",
"https://www.exploit-db.com/exploits/43935/"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "42.3"
},
{
"last_affected": "42.3"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2017-18078",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442214,
"published_at": "2018-01-29T05:29:00.213+00:00"
}