A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1638 advisory.

    This advisory aggregates security fixes for the systemd SRPM in CIQ LTS 9.6. It addresses 11 CVEs:
    CVE-2018-15688, CVE-2019-6454, CVE-2020-1712, CVE-2021-4034, CVE-2018-6954, and 6 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0497 advisory.

    This advisory aggregates security fixes for the systemd SRPM in CIQ LTS 9.2. It addresses 12 CVEs:
    CVE-2025-4598, CVE-2018-15688, CVE-2019-6454, CVE-2018-16865, CVE-2018-15687, and 7 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Fix a local vulnerability from a race condition in     chown-recursive (CVE-2018-15687, #1639076)

  - Fix a local vulnerability from invalid handling of long     lines in state deserialization (CVE-2018-15686,     #1639071)

  - Fix a remote vulnerability in DHCPv6 in systemd-networkd     (CVE-2018-15688, #1639067)

  - The DHCP server is started only when link is UP

  - DHCPv6 prefix delegation is improved

  - Downgrade logging of various messages and add loging in     other places

  - Many many fixes in error handling and minor memory leaks     and such

  - Fix typos and omissions in documentation

  - Typo in %%_environmnentdir rpm macro is fixed (with     backwards compatibility preserved)

  - Matching by MACAddress= in systemd-networkd is fixed

  - Creation of user runtime directories is improved, and     the user manager is only stopped after 10 s after the     user logs out (#1642460 and other bugs)

  - systemd units systemd-timesyncd, systemd-resolved,     systemd-networkd are switched back to use DynamicUser=0

  - Aliases are now resolved when loading modules from pid1.
    This is a (redundant) fix for a brief kernel regression.

  - 'systemctl --wait start' exits immediately if no valid     units are named

  - zram devices are not considered as candidates for     hibernation

  - ECN is not requested for both in- and out-going     connections (the sysctl overide for net.ipv4.tcp_ecn is     removed)

  - Various smaller improvements to unit ordering and     dependencies

  - generators are now called with the manager's environment

  - Handling of invalid (intentionally corrupt) dbus     messages is improved, fixing potential local DOS avenues

  - The target of symlinks links in .wants/ and .requires/     is now ignored. This fixes an issue where the unit file     would sometimes be loaded from such a symlink, leading     to non-deterministic unit contents.

  - Filtering of kernel threads is improved. This fixes an     issues with newer kernels where hybrid kernel/user     threads are used by bpfilter.

  - 'noresume' can be used on the kernel command line to     force normal boot even if a hibernation images is     present

  - Hibernation is not advertised if resume= is not present     on the kernenl command line

  - Hibernation/Suspend/... modes can be disabled using     AllowSuspend=, AllowHibernation=,     AllowSuspendThenHibernate=, AllowHybridSleep=

  - LOGO= and DOCUMENTATION_URL= are documented for the     os-release file

  - The hashmap mempool is now only used internally in     systemd, and is disabled for external users of the     systemd libraries

  - Additional state is serialized/deserialized when logind     is restarted, fixing the handling of user objects

  - Catalog entries for the journal are improved (#1639482)

  - If suspend fails, the post-suspend hooks are still     called.

  - Various build issues on less-common architectures are     fixed

No need to reboot or log out.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fix a local vulnerability from a race condition in     chown-recursive (CVE-2018-15687, #1643367)

  - Fix a local vulnerability from invalid handling of long     lines in state deserialization (CVE-2018-15686,     #1643372)

  - Fix a remote vulnerability in DHCPv6 in systemd-networkd     (CVE-2018-15688, #1643362)

  - Downgrade logging of various messages and add loging in     other places

  - Many many fixes in error handling and minor memory leaks     and such

  - Fix typos and omissions in documentation

  - Various smaller improvements to unit ordering and     dependencies

  - Handling of invalid (intentionally corrupt) dbus     messages is improved, fixing potential local DOS avenues

  - The target of symlinks links in .wants/ and .requires/     is now ignored. This fixes an issue where the unit file     would sometimes be loaded from such a symlink, leading     to non-deterministic unit contents.

  - Filtering of kernel threads is improved. This fixes an     issues with newer kernels where hybrid kernel/user     threads are used by bpfilter.

  - Catalog entries for the journal are improved (#1639482)

No need to reboot or log out.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3816-1 advisory.

    Jann Horn discovered that unit_deserialize incorrectly handled status messages above a certain length. A     local attacker could potentially exploit this via NotifyAccess to inject arbitrary state across re-     execution and obtain root privileges. (CVE-2018-15686)

    Jann Horn discovered a race condition in chown_one(). A local attacker could potentially exploit this by     setting arbitrary permissions on certain files to obtain root privileges. This issue only affected Ubuntu     18.04 LTS and Ubuntu 18.10. (CVE-2018-15687)

    It was discovered that systemd-tmpfiles mishandled symlinks in non-terminal path components. A local     attacker could potentially exploit this by gaining ownership of certain files to obtain root privileges.
    This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-6954)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201810-10 (systemd: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in systemd. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker could possibly execute arbitrary code, cause a Denial of       Service condition, or gain escalated privileges.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Type	Severity
364619	Rocky Linux 9.6 [CIQ] Security Update: rhel-net-naming-sysattrs / systemd / systemd-boot-unsigned / etc Multiple Vulnerabilities (ciqsa-2026_1638)	Nessus	Rocky Linux Local Security Checks	Local	high
355266	Rocky Linux 9.2 [CIQ] Security Update: systemd / systemd-boot-unsigned / systemd-boot-unsigned-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0497)	Nessus	Rocky Linux Local Security Checks	Local	medium
120769	Fedora 29 : systemd (2018-c402eea18b)	Nessus	Fedora Local Security Checks	Local	high
120295	Fedora 28 : systemd (2018-24bd6c9d4a)	Nessus	Fedora Local Security Checks	Local	high
118907	Ubuntu 16.04 LTS / 18.04 LTS : systemd vulnerabilities (USN-3816-1)	Nessus	Ubuntu Local Security Checks	Local	high
118510	GLSA-201810-10 : systemd: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high

Detections

Analytics

CVE-2018-15687

high

Tenable Plugins

high

medium

high

high

high

high