{"id":"CVE-2016-10156","aliases":["DEBIAN-CVE-2016-10156","EUVD-2016-1344","GHSA-4r87-5wgm-7h7m","SUSE-SU-2017:0279-1","UBUNTU-CVE-2016-10156","openSUSE-SU-2024:11420-1"],"status":"published","title":"A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created...","description":"A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01213,"percentile":0.68719,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-264"],"published":"2017-01-23T06:49:00Z","modified":"2026-10-24T14:04:16Z","exploits":[{"source":"exploitdb","id":"EDB-41171","title":"Systemd 228 (SUSE 12 SP2 / Ubuntu Touch 15.04) - Local Privilege Escalation","type":"local","platform":"linux","date":"2017-01-24","url":"https://www.exploit-db.com/exploits/41171"}],"fixes":[{"ecosystem":"Debian:12","package":"systemd","fixed_in":["229-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"systemd","fixed_in":["229-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"systemd","fixed_in":["229-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"systemd","fixed_in":["228-132.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"systemd","fixed_in":["228-132.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"systemd","fixed_in":["228-132.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"systemd","fixed_in":["228-132.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"systemd","fixed_in":["228-132.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"229-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"229-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"229-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-132.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-132.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-132.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-132.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-132.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"249.4-2.2"}]}],"bundled":19}],"products":[{"vendor":"systemd_project","product":"systemd"}],"references":[{"url":"https://github.com/systemd/systemd/commit/06eeacb6fe029804f296b065b3ce91e796e1cd0e","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1020601","tags":["x_refsource_MISC","x_transferred","Issue Tracking","report"]},{"url":"http://www.securitytracker.com/id/1037686","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://www.exploit-db.com/exploits/41171/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/95790","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/systemd/systemd/commit/ee735086f8670be1591fa9593e80dd60163a7a2f","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10156"},{"url":"https://www.exploit-db.com/exploits/41171"},{"url":"https://github.com/advisories/GHSA-4r87-5wgm-7h7m"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-10156","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170279-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1012266","tags":["report"]},{"url":"https://bugzilla.suse.com/1014560","tags":["report"]},{"url":"https://bugzilla.suse.com/1014566","tags":["report"]},{"url":"https://bugzilla.suse.com/1020601","tags":["report"]},{"url":"https://bugzilla.suse.com/997682","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10156","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-10156","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10156","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-21029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33910","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-10156","description":"A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229.","status":"published","published":"2017-01-23T06:49:00Z","modified":"2024-08-06T03:14:42.637Z","updated_at":"2026-11-02T14:33:31.764001Z"}],"euvd":[{"id":"EUVD-2016-1344","description":"A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229.","status":"published","published":"2017-01-23T06:49:00Z","modified":"2024-08-06T03:14:42Z","updated_at":"2026-11-03T02:22:24.738409Z"}],"ghsa":[{"id":"GHSA-4r87-5wgm-7h7m","title":"A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created...","description":"A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229.","status":"published","published":"2022-05-17T02:26:02Z","modified":"2025-04-20T03:32:27Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:01:39.626411Z"}],"nvd":[{"id":"CVE-2016-10156","description":"A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229.","status":"published","published":"2017-01-23T07:59:00.347Z","modified":"2026-06-17T00:39:10.26Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:35.029632Z"}],"osv":[{"id":"CVE-2016-10156","description":"A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229.","status":"published","published":"2017-01-23T07:59:00.347Z","modified":"2026-10-24T14:04:16.59109089Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"DEBIAN-CVE-2016-10156","description":"A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229.","status":"published","published":"2017-01-23T07:59:00.347Z","modified":"2026-09-22T07:00:16.23027426Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-10156","description":"A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229.","status":"withdrawn","published":"2017-01-23T07:59:00Z","modified":"2025-07-16T07:02:11.721659Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"openSUSE-SU-2024:11420-1","title":"libsystemd0-249.4-2.2 on GA media","description":"These are all security issues fixed in the libsystemd0-249.4-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:22.858405Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2017:0279-1","title":"Security update for systemd","description":"\nThis update for systemd fixes the following issues:\n\nThis security issue was fixed:\n\n- CVE-2016-10156: Fix permissions set on permanent timer timestamp files, preventing local unprivileged users from escalating privileges (bsc#1020601).\n\nThese non-security issues were fixed:\n\n- Fix permission set on /var/lib/systemd/linger/*\n- install: follow config_path symlink (#3362)\n- install: fix disable when /etc/systemd/system is a symlink (bsc#1014560)\n- run: make --slice= work in conjunction with --scope (bsc#1014566)\n- core: don't dispatch load queue when setting Slice= for transient units\n- systemctl: remove duplicate entries showed by list-dependencies (#5049) (bsc#1012266)\n- rule: don't automatically online standby memory on s390x (bsc#997682)\n","status":"published","published":"2017-01-25T08:17:29Z","modified":"2026-02-04T03:45:36.088247Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}