CVE-2023-26604High· 7.8▾ MidnightPoC availablesystemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 42.9 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.1%
Exploit / PoC code exists
systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.
debian_linux = 10.0systemd < 246.7Upgrade past the affected range:
systemd 246.7Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2020-13776Medium· 6.7systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended
CVE-2022-45873Medium· 5.5systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace
CVE-2022-3821Medium· 5.5An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c
CVE-2021-33910Medium· 5.5basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system c…
CVE-2021-3997Medium· 5.5A flaw was found in systemd
CVE-2020-13529Medium· 6.1An exploitable denial-of-service vulnerability exists in Systemd 245