CVE-2016-10156

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-01-23 · updated 2026-06-17
Weakness: CWE-264

Description

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229.

Affected products

systemd: 228

References

http://www.securityfocus.com/bid/95790
http://www.securitytracker.com/id/1037686
https://bugzilla.suse.com/show_bug.cgi?id=1020601
https://github.com/systemd/systemd/commit/06eeacb6fe029804f296b065b3ce91e796e1cd0e
https://github.com/systemd/systemd/commit/ee735086f8670be1591fa9593e80dd60163a7a2f
https://www.exploit-db.com/exploits/41171/
http://www.securityfocus.com/bid/95790
http://www.securitytracker.com/id/1037686
https://bugzilla.suse.com/show_bug.cgi?id=1020601
https://github.com/systemd/systemd/commit/06eeacb6fe029804f296b065b3ce91e796e1cd0e
https://github.com/systemd/systemd/commit/ee735086f8670be1591fa9593e80dd60163a7a2f
https://www.exploit-db.com/exploits/41171/

Get alerted when CVE-2016-10156 or the next vulnerability affects your stack