Description

systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.7",
  "pubDate": "2026-08-10T14:17:21.277Z",
  "pubdate": "2026-08-10T14:17:21.277Z",
  "executiveSummary": "A local privilege escalation vulnerability exists within systemd-homed due to improper handling of system group assignments for local, logged-in, homed-managed users.\nThe vulnerability allows an unprivileged, authenticated local attacker to arbitrarily add system groups to their user profile.\nAffected systems are those running vulnerable versions of systemd-homed where user record modifications lack sufficient validation and authorization controls during runtime or session management.\nThe risk implication is severe, as arbitrary system group membership can grant unauthorized access to sensitive system resources, device nodes, or administrative capabilities traditionally restricted to privileged groups such as wheel, sudo, or docker.\nTo exploit this flaw, the attacker must already possess local interactive access to the target system as a homed-managed user.\nSuccessful exploitation results in unauthorized vertical privilege escalation, potentially allowing the attacker to achieve full root code execution depending on the specific system groups appended during the attack.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and authorization enforcement within the systemd-homed component when processing user record updates related to supplementary and system group memberships.\nSpecifically, the service fails to adequately restrict which groups a local, logged-in user can append to their own security context or identity record managed by systemd-homed.\nThe vulnerable component is the user record management and IPC interface exposed by systemd-homed for maintaining local user properties.\nAuthentication requirements dictate that the attacker must have a valid local session and be authenticated as a homed-managed user, meaning zero-day remote exploitation is not feasible without prior local access.\nPrivilege requirements are initially low, as the attacker operates as a standard, unprivileged user managed by systemd-homed.\nNetwork exposure is non-existent, as the vulnerability is strictly local and mediated through internal D-Bus or IPC mechanisms used by systemd-homed.\nThe attack flow proceeds as follows: First, the attacker establishes a local interactive session on the target system. Second, leveraging the insecure validation logic in systemd-homed, the attacker interacts with the user management interface to modify their local user record.\nThird, the attacker injects arbitrary system group identifiers into their group membership properties. Because systemd-homed fails to validate these additions against permitted privilege boundaries, the modified user record is accepted and applied.\nFourth, upon subsequent authentication, session initialization, or process spawning, the operating system assigns the newly acquired system groups to the attacker's process token.\nPost-exploitation impact involves the attacker leveraging the privileges associated with the newly acquired system groups. If sensitive groups such as shadow, disk, or sudo are appended, the attacker can read sensitive credential stores, access raw block devices to extract sensitive data, or directly execute arbitrary commands with root privileges via administrative utilities."
}