CVE-2017-15908

systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user.

In systemd versions up to 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, leading to arbitrary data being written beyond its end.

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root.

A vulnerability was found in systemd where a service using the DynamicUser property can create a SUID/SGID binary that remains executable with the transient service UID/GID even after the service terminates. A local attacker could exploit this to access resources owned by a potentially different UID/GID.

A vulnerability in systemd causes systemd-coredump to ignore the kernel's fs.suid_dumpable setting, potentially leading to a local information leak.

In udev in systemd before version 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

In systemd versions 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file in nspawn.

It was discovered that a systemd service using the DynamicUser property can gain new privileges through the execution of SUID binaries, allowing creation of binaries owned by the service's transient group with the setgid bit set. A local attacker may exploit this flaw to access resources that will be.

A flaw was found in systemd where uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.

There is a stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.