Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestions search

Untriaged
Filter by:
With package: ocamlPackages.systemd

Found 1 matching suggestions

View:
Compact
Detailed
Permalink CVE-2026-16552
6.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 month, 1 week ago Activity log
  • Created suggestion 1 month, 1 week ago
Systemd: systemd-tmpfiles symlink-redirected arbitrary file overwrite via a chase_safe root-to-unprivileged ownership transition bypass

A flaw was found in systemd-tmpfiles. When processing a tmpfiles.d configuration entry that writes to a file, systemd-tmpfiles can follow a symbolic link placed by an unprivileged local user, and an existing safety check does not detect this specific case because it always treats transitions away from the root user as safe. On systems where a tmpfiles.d configuration targets a path an unprivileged user can influence, this could allow that user to redirect a privileged systemd-tmpfiles write to a file of their choosing, though the content written remains determined by the existing configuration rather than by the unprivileged user. The highest threat from this vulnerability is to integrity.

Affected products

systemd

Matching in nixpkgs

pkgs.udev

System and service manager for Linux

  • nixos-unstable -
    • nixos-unstable-small 261
  • nixos-26.05 -
    • nixos-26.05-small 260.2

pkgs.systemd

System and service manager for Linux

  • nixos-unstable -
    • nixos-unstable-small 261
  • nixos-26.05 -
    • nixos-26.05-small 260.2

pkgs.systemd-lsp

Language server implementation for systemd unit files made in Rust

pkgs.systemdLibs

System and service manager for Linux

  • nixos-unstable -
    • nixos-unstable-small 261
  • nixos-26.05 -
    • nixos-26.05-small 260.2

pkgs.rofi-systemd

Control your systemd units using rofi

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.1.0

pkgs.systemdUkify

System and service manager for Linux

  • nixos-unstable -
    • nixos-unstable-small 261
  • nixos-26.05 -
    • nixos-26.05-small 260.2

pkgs.systemdMinimal

System and service manager for Linux

  • nixos-unstable -
    • nixos-unstable-small 261
  • nixos-26.05 -
    • nixos-26.05-small 260.2

pkgs.systemd-netlogd

Forwards messages from the journal to other hosts over the network

  • nixos-unstable -
    • nixos-unstable-small 1.4.4
  • nixos-26.05 -
    • nixos-26.05-small 1.4.4

pkgs.systemd-bootchart

Boot performance graphing tool from systemd

  • nixos-unstable -
    • nixos-unstable-small 235
  • nixos-26.05 -
    • nixos-26.05-small 235

pkgs.systemd-credsubst

envsubst for systemd credentials

  • nixos-unstable -
    • nixos-unstable-small 0.1.0
  • nixos-26.05 -
    • nixos-26.05-small 0.1.0

pkgs.systemd-manager-tui

Program for managing systemd services through a TUI

  • nixos-unstable -
    • nixos-unstable-small 1.2.4
  • nixos-26.05 -
    • nixos-26.05-small 1.2.4

pkgs.systemd-lock-handler

Translates systemd-system lock/sleep signals into systemd-user target activations

  • nixos-unstable -
    • nixos-unstable-small 2.4.2
  • nixos-26.05 -
    • nixos-26.05-small 2.4.2

pkgs.ocamlPackages.systemd

OCaml module for native access to the systemd facilities

  • nixos-unstable -
    • nixos-unstable-small 1.3
  • nixos-26.05 -
    • nixos-26.05-small 1.3

pkgs.update-systemd-resolved

Helper script for OpenVPN to directly update the DNS settings of a link through systemd-resolved via DBus

  • nixos-unstable -
    • nixos-unstable-small 1.3.0
  • nixos-26.05 -
    • nixos-26.05-small 1.3.0

pkgs.ocamlPackages_latest.systemd

OCaml module for native access to the systemd facilities

  • nixos-unstable -
    • nixos-unstable-small 1.3
  • nixos-26.05 -
    • nixos-26.05-small 1.3

pkgs.gnomeExtensions.systemd-manager-neo

Monitor and manage system and user systemd services directly from the GNOME top panel. Features RAM/Uptime tracking and easy log access.

  • nixos-unstable -
    • nixos-unstable-small 6
  • nixos-26.05 -
    • nixos-26.05-small 6

pkgs.python313Packages.systemdunitparser

SystemdUnitParser is an extension to Python's configparser.RawConfigParser to properly parse systemd unit files

  • nixos-unstable -
    • nixos-unstable-small 0.4
  • nixos-26.05 -
    • nixos-26.05-small 0.4

pkgs.python314Packages.systemdunitparser

SystemdUnitParser is an extension to Python's configparser.RawConfigParser to properly parse systemd unit files

  • nixos-unstable -
    • nixos-unstable-small 0.4
  • nixos-26.05 -
    • nixos-26.05-small 0.4

Package maintainers