CVE-2017-18078: Debian Linux

High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days.

systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.

Affected products

• Debian Debian Linux: version 8.0 only
• Opensuse Leap: version 42.3 only
• Systemd Project Systemd: before 237 (fixed in 237)

Published 2018-01-29. Last modified 2026-06-17.