CVE-2023-26604

Katalog CVE

CVSS 7.8 · High EPSS 1,1%

Kerentanan Improper Privilege Management pada debian linux, systemd project systemd. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

Rincian

Terbit di NVD

3 Maret 2023

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/174130/systemd-246-Local-Root-Privilege-Escalation.html exploit · advisory pihak ketiga
• https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-2-insecure-functionality/ exploit · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/03/msg00032.html mailing list · advisory pihak ketiga
• https://medium.com/%40zenmoviefornotification/saidov-maxim-cve-2023-26604-c1232a526ba7 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20230505-0009/ advisory pihak ketiga
• https://github.com/systemd/systemd/blob/main/NEWS#L4335-L4340 release notes