CVE-2023-26604
📋 TL;DR
This vulnerability allows local privilege escalation when users run 'systemctl status' via Sudo in certain configurations. Attackers can escape from the less pager to execute arbitrary commands with root privileges. Systems running systemd versions before 247 with permissive sudoers configurations are affected.
💻 Affected Systems
- systemd
📦 What is this software?
Systemd by Systemd Project
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full root privileges and complete system compromise.
Likely Case
Privileged user accidentally or maliciously escalates privileges through legitimate sudo access.
If Mitigated
Minimal impact with proper sudoers restrictions and updated systemd.
🎯 Exploit Status
Exploitation requires local access and sudo privileges for systemctl status command.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: systemd 247 and later
Vendor Advisory: https://lists.debian.org/debian-lts-announce/2023/03/msg00032.html
Restart Required: No
Instructions:
1. Update systemd to version 247 or later using your distribution's package manager. 2. For Debian/Ubuntu: sudo apt update && sudo apt upgrade systemd. 3. For RHEL/CentOS: sudo yum update systemd. 4. For Arch: sudo pacman -Syu systemd.
🔧 Temporary Workarounds
Restrict sudoers configuration
linuxRemove or restrict 'systemctl status' commands in sudoers files to prevent exploitation.
sudo visudo
# Review and modify sudoers entries to restrict systemctl commands
Set LESSSECURE environment variable
linuxManually set LESSSECURE=1 to prevent less from executing external commands.
export LESSSECURE=1
# Add to shell profiles or systemd service files
🧯 If You Can't Patch
- Review and restrict sudoers configurations to remove 'systemctl status' permissions
- Implement strict access controls and monitor for unusual privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check systemd version with 'systemd --version' and verify if below 247. Review sudoers with 'sudo -l' for systemctl permissions.Check Version:
systemd --version | head -n1Verify Fix Applied:
Confirm systemd version is 247 or higher with 'systemd --version'. Test that LESSSECURE is set when running systemctl.📡 Detection & Monitoring
Log Indicators:
- Unusual sudo executions of systemctl status
- Privilege escalation attempts in audit logs
- Unexpected root shell spawns from less
Network Indicators:
- None - this is a local privilege escalation
SIEM Query:
source="sudo" AND command="systemctl status" | stats count by user, host🔗 References
- http://packetstormsecurity.com/files/174130/systemd-246-Local-Root-Privilege-Escalation.html
- https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-2-insecure-functionality/
- https://github.com/systemd/systemd/blob/main/NEWS#L4335-L4340
- https://lists.debian.org/debian-lts-announce/2023/03/msg00032.html
- https://medium.com/%40zenmoviefornotification/saidov-maxim-cve-2023-26604-c1232a526ba7
- https://security.netapp.com/advisory/ntap-20230505-0009/
- http://packetstormsecurity.com/files/174130/systemd-246-Local-Root-Privilege-Escalation.html
- https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-2-insecure-functionality/
- https://github.com/systemd/systemd/blob/main/NEWS#L4335-L4340
- https://lists.debian.org/debian-lts-announce/2023/03/msg00032.html
- https://medium.com/%40zenmoviefornotification/saidov-maxim-cve-2023-26604-c1232a526ba7
- https://security.netapp.com/advisory/ntap-20230505-0009/
