CVE-2018-6954

Red Hat statement

This flaw affects in particular those systems where custom tmpfiles files are configured (e.g. in /etc/tmpfiles.d). Indeed systemd-tmpfiles installed by system packages set privileges of a directory either to root or to a service specific user and not to interactive users. Even in case they provide one of the vulnerable tmpfiles configuration file (e.g. recursive "Z" type entries), an attacker would still need to perform the attack as the service specific user, which means they would first need to compromise that service. Moreover, systemd-tmpfiles service is automatically executed only when the system boots, when it is very unlikely an attacker has already a chance to perform any action at all. Otherwise, an attacker would have to wait for an administrator to manually run the `systemd-tmpfiles --create` command.

Red Hat mitigation

There is no known mitigation available.