Comment Re:yet another reason to dislike systmed (Score 1) 75
The plugin is definitely at fault; code - especially privileged code - should never use unvalidated external input to determine paths. A proportion of blame however has to lie with the systemd-networkd interface: the vulnerability derives from accepting string-valued updates off of D-Bus representing a set of enumerated values, but where the values and their string representation are completely undocumented.
The only way to validate these values is to copy/paste table data found in the bowels of the systemd source tree. Some parts of systemd are very well documented; others are woefully not, and present an interface that is irredeemably fragile.