CVE-2023-26604
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.
Risk Assessment
A local user with permission to run systemctl via Sudo may gain root privileges, posing a serious threat to system confidentiality and integrity.
Recommendation
Update systemd to version 247 or later and review sudoers files to restrict the ability to run systemctl status via Sudo.
Other vulnerabilities in systemd
See all- CVE-2026-29111Medium
In systemd (system and service manager running as PID 1), an unprivileged IPC API call with spurious data triggers an assert and freezes execution. On version v249 and older the effect is stack overwriting with attacker-controlled content, while from v250 the safety check causes an assert instead. The IPC call was added in v239, so older versions are not affected.
- CVE-2017-15908High
In systemd versions 223 through 235, a remote DNS server can respond with a custom crafted NSEC resource record to trigger an infinite loop in the dns_packet_read_type_window() function of the 'systemd-resolved' service, causing a DoS of the affected service.
- CVE-2017-9445High
In systemd versions up to 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, leading to arbitrary data being written beyond its end.
- CVE-2016-10156High
A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root.
- CVE-2026-40226Medium
In systemd versions 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file in nspawn.
- CVE-2026-40225Medium
In udev in systemd before version 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.
- CVE-2022-4415Medium
A vulnerability in systemd causes systemd-coredump to ignore the kernel's fs.suid_dumpable setting, potentially leading to a local information leak.
- CVE-2019-3843High
A vulnerability was found in systemd where a service using the DynamicUser property can create a SUID/SGID binary that remains executable with the transient service UID/GID even after the service terminates. A local attacker could exploit this to access resources owned by a potentially different UID/GID.
- CVE-2019-3844High
It was discovered that a systemd service using the DynamicUser property can gain new privileges through the execution of SUID binaries, allowing creation of binaries owned by the service's transient group with the setgid bit set. A local attacker may exploit this flaw to access resources that will be.
- CVE-2021-33910Medium
In systemd before versions 246.15, 247.8, 248.5, and 249.1, basic/unit-name.c has excessive memory allocation (via strdupa and alloca) for a pathname controlled by a local attacker, leading to an operating system crash.
Original NVD description (English source)
systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS