Description

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-10T14:17:20.760Z",
  "pubdate": "2026-08-10T14:17:20.760Z",
  "executiveSummary": "A path traversal vulnerability exists within the systemd-oomd IPC API, specifically affecting local process termination handling.\nThe vulnerability allows local unprivileged users to terminate arbitrary local processes without possessing the requisite administrative privileges.\nThe core issue stems from a missing path traversal validation check within the IPC API implementation when interacting with systemd-oomd.\nSuccessful exploitation requires local access to the target system, allowing low-privileged actors to disrupt critical services, induce denial-of-service conditions, or terminate sensitive user and system processes arbitrarily.\nThe risk implication is significant for multi-tenant or shared environments where process isolation and privilege boundaries must be strictly enforced.\nNo specific network exposure is required, as the attack vector is strictly local, leveraging inter-process communication interfaces exposed by the affected component.",
  "technicalDetails": "The vulnerability resides in the systemd-oomd IPC API component responsible for managing and terminating processes based on memory pressure and control group metrics.\nThe root cause of the security defect is the complete absence of rigorous path traversal validation within the input handling routines of the IPC interface.\nBecause the API fails to sanitize or canonicalize paths properly when parsing requests, an unprivileged local user can manipulate input parameters to reference unintended control groups or process identifiers outside their permitted scope.\nThe attack flow proceeds as follows: an unprivileged local attacker crafts a malicious IPC request containing path traversal sequences directed at the systemd-oomd socket.\nUpon receiving the payload, the vulnerable component fails to validate the boundaries of the target path or identifier, interpreting the traversal sequences as legitimate references.\nSystemd-oomd then processes the request against the manipulated target, executing the termination command on the referenced arbitrary process.\nThe authentication and privilege requirements are minimal; the attacker only requires local execution capability as an unprivileged user to interact with the IPC mechanism.\nPost-exploitation impact includes localized denial of service, premature termination of essential system daemons or other users' application processes, and potential system instability stemming from unauthorized control over process lifecycles."
}