CVE-2023-26604
Published: 03 March 2023
Summary
CVE-2023-26604 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Debian Debian Linux. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 9.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
systemd versions prior to 247 contain a local privilege-escalation weakness that affects certain sudoers configurations permitting execution of “systemctl status.” The component fails to set the LESSSECURE environment variable to 1, allowing the less pager invoked by systemctl to spawn additional programs when the terminal is too narrow to display full output; because less then runs with root privileges, an attacker can escape to a root shell.
A local user who is already granted limited sudo rights to systemctl can exploit the flaw by resizing the terminal and invoking a shell escape from within less, thereby obtaining an unrestricted root session. The attack requires no user interaction beyond the ability to run the permitted command and depends on the presence of plausible sudoers entries that reference systemctl.
Advisories such as the Debian LTS announcement and the systemd NEWS entry recommend upgrading to a patched release that enforces LESSSECURE or avoiding systemctl in sudoers files; the referenced Compass Security and Medium posts further advise reviewing sudoers entries that invoke interactive pagers or other programs that may shell out.
A proof-of-concept exploit has been published on Packet Storm, yet the EPSS score has remained essentially flat near 0.056 since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-30399
Vulnerability details
systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may…
more
be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Policy addresses roles, responsibilities, and privilege management to prevent improper privilege assignments.
Access supervision ensures privileges are assigned and managed without improper escalation or retention.
Assigning group/role memberships and access authorizations (privileges) while reviewing accounts addresses improper privilege management.
Enforces proper privilege management by requiring all decisions through the verified reference monitor.
By mandating division of duties across roles, the control enforces proper privilege management and prevents a single entity from controlling an entire sensitive process.
Implements core proper privilege management by restricting to only required rights.
Policy requires training on privilege management and least privilege, making it harder to exploit improper privilege management weaknesses.
Training covers proper privilege management practices, making incorrect privilege assignments less likely.