Improper Privilege Management in systemd - CVE-2023-26604

Vulnerability identifier: #VU74146

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-26604

CWE-ID: CWE-269

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper privilege management for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

systemd
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libgudev1
libgudev1-devel
systemd-devel
systemd-journal-gateway
systemd-libs
systemd-networkd
systemd-python
systemd-resolved
systemd-sysv
systemd (Red Hat package)
systemd-bash-completion
libsystemd0
libudev1-32bit
libsystemd0-32bit
udev-debuginfo
libudev1-debuginfo-32bit
systemd-sysvinit
systemd-debuginfo-32bit
libudev1
systemd-debuginfo
libsystemd0-debuginfo-32bit
systemd-32bit
libsystemd0-debuginfo
libudev1-debuginfo
libudev-devel
udev
systemd-debugsource
systemd-udev
systemd-container
systemd-journal-remote
systemd-pam
systemd-tests
systemd-udev-compat
systemd-timesyncd
systemd-nspawn
systemd-help
systemd-portable-debuginfo
libsystemd0-32bit-debuginfo
nss-mymachines-32bit
systemd-32bit-debuginfo
nss-myhostname-32bit-debuginfo
libudev-devel-32bit
libudev-mini-devel
nss-myhostname-debuginfo
systemd-journal-remote-debuginfo
systemd-logger
nss-mymachines-64bit
systemd-mini-debuginfo
nss-mymachines-64bit-debuginfo
libudev1-64bit
nss-myhostname-64bit-debuginfo
libsystemd0-64bit-debuginfo
nss-myhostname-64bit
libudev1-64bit-debuginfo
systemd-64bit
nss-myhostname-32bit
libsystemd0-64bit
libudev-devel-64bit
systemd-64bit-debuginfo
systemd-lang
nss-mymachines-32bit-debuginfo
libudev1-32bit-debuginfo
systemd-network-debuginfo
nss-systemd-debuginfo
udev-mini-debuginfo
systemd-mini-debugsource
systemd-mini-container
systemd-portable
systemd-doc
nss-mymachines
nss-resolve
nss-myhostname
systemd-mini-container-debuginfo
libsystemd0-mini-debuginfo
libudev-mini1-debuginfo
systemd-coredump
nss-mymachines-debuginfo
systemd-network
libsystemd0-mini
libudev-mini1
udev-mini
nss-resolve-debuginfo
systemd-mini-devel
systemd-container-debuginfo
systemd-mini-sysvinit
nss-systemd
systemd-coredump-debuginfo
systemd-mini
SUSE Linux Enterprise Server 15 SP3
Oracle Linux
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Anolis OS
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server 12 SP2 BCL
SUSE Linux Enterprise Server 12 SP4 ESPOS
SUSE Linux Enterprise Server 12 SP4 LTSS
openSUSE Leap
openEuler
Gatekeeper Operator
VolSync
Red Hat CodeReady Workspaces for OpenShift
Service Telemetry Framework
Migration Toolkit for Virtualization
Red Hat OpenShift Dev Spaces
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Oracle Communications Cloud Native Core Network Exposure Function
Netcool Operations Insight
IBM MQ Operator
Red Hat Advanced Cluster Security for Kubernetes
App Connect Enterprise Certified Container
Session Smart Router
Self Node Remediation Operator
OpenShift sandboxed containers
Red Hat OpenShift Serverless
OpenShift Service Mesh
OpenShift Data Foundation (formerly OpenShift Container Storage)
OpenShift Container Platform for Windows Containers
OpenShift Virtualization
Secondary Scheduler Operator for Red Hat OpenShift (OSSO)
OpenShift API for Data Protection (OADP)
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Red Hat OpenShift GitOps
Juniper Secure Analytics (JSA)
Robotic Process Automation for Cloud Pak
ObjectScale
IBM Cloud Pak for Watson AIOps
IBM supplied MQ Advanced container images
Total Storage Service Console (TSSC) / TS4500 IMC
Dell PowerProtect Cyber Recovery
RecoverPoint for VMs
IBM Storage Scale System
IBM Qradar SIEM

Install updates from vendor's website.

systemd - update to 247
VolSync - addressed in versions 0.5.4, 0.6.3, 0.7.3
Self Node Remediation Operator - update to 0.5.1
Secondary Scheduler Operator for Red Hat OpenShift (OSSO) - update to 1.1.2
OpenShift API for Data Protection (OADP) - update to 1.0.11
OpenShift sandboxed containers - update to 1.4.1
Service Telemetry Framework - update to 1.5.4
Migration Toolkit for Containers - addressed in versions 1.7.11, 1.7.12
Red Hat OpenShift GitOps - addressed in versions 1.10.4, 1.11.3, 1.12.0
Red Hat OpenShift Serverless - update to 1.29.1
OpenShift Service Mesh - addressed in versions 2.2.8, 2.3.5, 2.4.1, 2.5.1
Migration Toolkit for Virtualization - update to 2.4.3
Red Hat OpenShift Dev Spaces - update to 3.7.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.0
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.10.14, 4.11.9, 4.12.5
Red Hat OpenShift Container Platform - addressed in versions 4.11.59, 4.12.53, 4.15.2, 4.15.3
OpenShift Container Platform for Windows Containers - update to 6.0.1
Juniper Secure Analytics (JSA) - update to 7.5.0 UP8 IF03
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.11, 23.0.12
ObjectScale - update to 1.4.0
Netcool Operations Insight - update to 1.6.12
IBM MQ Operator - addressed in versions 2.0.13, 2.4.2
Red Hat Advanced Cluster Security for Kubernetes - update to 4.1
IBM Cloud Pak for Watson AIOps - update to 4.2.0
OpenShift Virtualization - update to 4.12.5
App Connect Enterprise Certified Container - addressed in versions 5.0.9, 9.1.0
RecoverPoint for VMs - update to 6.0.SP1.P1
IBM Storage Scale System - addressed in versions 6.1.2.8, 6.1.9.0
Session Smart Router - addressed in versions 6.2.10, 6.3.7
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF01
IBM supplied MQ Advanced container images - update to 9.3.0.10-r1
Total Storage Service Console (TSSC) / TS4500 IMC - update to 9.4.26/9.5.8
Dell PowerProtect Cyber Recovery - update to 19.14.0.1
systemd - addressed in versions 219-78, 239-74.0.2
libgudev1 - update to 219-78
libgudev1-devel - update to 219-78
systemd-devel - addressed in versions 219-78, 239-74.0.2
systemd-journal-gateway - update to 219-78
systemd-libs - addressed in versions 219-78, 239-74.0.2
systemd-networkd - update to 219-78
systemd-python - update to 219-78
systemd-resolved - update to 219-78
systemd-sysv - update to 219-78
systemd (Red Hat package) - addressed in versions 219-78.el7_9.11, 239-58.el8_6.13, 239-74.el8_8.2
systemd-bash-completion - addressed in versions 228-150.108.2, 228-157.52.1
libsystemd0 - addressed in versions 228-150.108.2, 228-157.52.1, 246.16-150300.7.60.1
libudev1-32bit - addressed in versions 228-150.108.2, 228-157.52.1, 246.16-150300.7.60.1
libsystemd0-32bit - addressed in versions 228-150.108.2, 228-157.52.1, 246.16-150300.7.60.1
udev-debuginfo - addressed in versions 228-150.108.2, 228-157.52.1, 246.16-150300.7.60.1
libudev1-debuginfo-32bit - addressed in versions 228-150.108.2, 228-157.52.1
systemd-sysvinit - addressed in versions 228-150.108.2, 228-157.52.1, 246.16-150300.7.60.1
systemd-debuginfo-32bit - addressed in versions 228-150.108.2, 228-157.52.1
libudev1 - addressed in versions 228-150.108.2, 228-157.52.1, 246.16-150300.7.60.1
systemd-debuginfo - addressed in versions 228-150.108.2, 228-157.52.1, 246.16-150300.7.60.1
systemd-devel - addressed in versions 228-150.108.2, 228-157.52.1, 246.16-150300.7.60.1
libsystemd0-debuginfo-32bit - addressed in versions 228-150.108.2, 228-157.52.1
systemd-32bit - addressed in versions 228-150.108.2, 228-157.52.1, 246.16-150300.7.60.1
libsystemd0-debuginfo - addressed in versions 228-150.108.2, 228-157.52.1, 246.16-150300.7.60.1
libudev1-debuginfo - addressed in versions 228-150.108.2, 228-157.52.1, 246.16-150300.7.60.1
libudev-devel - addressed in versions 228-150.108.2, 228-157.52.1, 246.16-150300.7.60.1
udev - addressed in versions 228-150.108.2, 228-157.52.1, 246.16-150300.7.60.1
systemd-debugsource - addressed in versions 228-150.108.2, 228-157.52.1, 246.16-150300.7.60.1
systemd - addressed in versions 228-150.108.2, 228-157.52.1, 246.16-150300.7.60.1
systemd-udev - update to 239-74.0.2
systemd-container - update to 239-74.0.2
systemd-journal-remote - update to 239-74.0.2
systemd-pam - update to 239-74.0.2
systemd-tests - update to 239-74.0.2
systemd-debuginfo - addressed in versions 243-59, 243-60
systemd-devel - addressed in versions 243-59, 243-60
systemd-networkd - update to 243-59
systemd-udev-compat - addressed in versions 243-59, 243-60
systemd-debugsource - addressed in versions 243-59, 243-60
systemd-resolved - update to 243-59
systemd-timesyncd - update to 243-59
systemd-libs - addressed in versions 243-59, 243-60
systemd-udev - addressed in versions 243-59, 243-60
systemd-nspawn - update to 243-59
systemd-container - addressed in versions 243-59, 243-60
systemd-help - addressed in versions 243-59, 243-60
systemd-journal-remote - addressed in versions 243-59, 243-60
systemd-pam - update to 243-59
systemd - addressed in versions 243-59, 243-60
systemd-portable-debuginfo - update to 246.16-150300.7.60.1
libsystemd0-32bit-debuginfo - update to 246.16-150300.7.60.1
nss-mymachines-32bit - update to 246.16-150300.7.60.1
systemd-32bit-debuginfo - update to 246.16-150300.7.60.1
nss-myhostname-32bit-debuginfo - update to 246.16-150300.7.60.1
libudev-devel-32bit - update to 246.16-150300.7.60.1
systemd-container - update to 246.16-150300.7.60.1
libudev-mini-devel - update to 246.16-150300.7.60.1
nss-myhostname-debuginfo - update to 246.16-150300.7.60.1
systemd-journal-remote-debuginfo - update to 246.16-150300.7.60.1
systemd-logger - update to 246.16-150300.7.60.1
nss-mymachines-64bit - update to 246.16-150300.7.60.1
systemd-mini-debuginfo - update to 246.16-150300.7.60.1
nss-mymachines-64bit-debuginfo - update to 246.16-150300.7.60.1
libudev1-64bit - update to 246.16-150300.7.60.1
nss-myhostname-64bit-debuginfo - update to 246.16-150300.7.60.1
libsystemd0-64bit-debuginfo - update to 246.16-150300.7.60.1
nss-myhostname-64bit - update to 246.16-150300.7.60.1
libudev1-64bit-debuginfo - update to 246.16-150300.7.60.1
systemd-64bit - update to 246.16-150300.7.60.1
nss-myhostname-32bit - update to 246.16-150300.7.60.1
libsystemd0-64bit - update to 246.16-150300.7.60.1
libudev-devel-64bit - update to 246.16-150300.7.60.1
systemd-64bit-debuginfo - update to 246.16-150300.7.60.1
systemd-lang - update to 246.16-150300.7.60.1
nss-mymachines-32bit-debuginfo - update to 246.16-150300.7.60.1
libudev1-32bit-debuginfo - update to 246.16-150300.7.60.1
systemd-network-debuginfo - update to 246.16-150300.7.60.1
nss-systemd-debuginfo - update to 246.16-150300.7.60.1
udev-mini-debuginfo - update to 246.16-150300.7.60.1
systemd-mini-debugsource - update to 246.16-150300.7.60.1
systemd-mini-container - update to 246.16-150300.7.60.1
systemd-portable - update to 246.16-150300.7.60.1
systemd-doc - update to 246.16-150300.7.60.1
nss-mymachines - update to 246.16-150300.7.60.1
nss-resolve - update to 246.16-150300.7.60.1
systemd-journal-remote - update to 246.16-150300.7.60.1
nss-myhostname - update to 246.16-150300.7.60.1
systemd-mini-container-debuginfo - update to 246.16-150300.7.60.1
libsystemd0-mini-debuginfo - update to 246.16-150300.7.60.1
libudev-mini1-debuginfo - update to 246.16-150300.7.60.1
systemd-coredump - update to 246.16-150300.7.60.1
nss-mymachines-debuginfo - update to 246.16-150300.7.60.1
systemd-network - update to 246.16-150300.7.60.1
libsystemd0-mini - update to 246.16-150300.7.60.1
libudev-mini1 - update to 246.16-150300.7.60.1
udev-mini - update to 246.16-150300.7.60.1
nss-resolve-debuginfo - update to 246.16-150300.7.60.1
systemd-mini-devel - update to 246.16-150300.7.60.1
systemd-container-debuginfo - update to 246.16-150300.7.60.1
systemd-mini-sysvinit - update to 246.16-150300.7.60.1
nss-systemd - update to 246.16-150300.7.60.1
systemd-coredump-debuginfo - update to 246.16-150300.7.60.1
systemd-mini - update to 246.16-150300.7.60.1

• https://medium.com/@zenmoviefornotification/saidov-maxim-cve-2023-26604-c1232a526ba7
• https://github.com/systemd/systemd/blob/main/NEWS#L4335-L4340
• https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-2-insecure-functionality/

• Privilege escalation in systemd
• SUSE update for systemd
• SUSE update for systemd
• Red Hat Enterprise Linux 8 update for systemd
• Multiple vulnerabilities in Red Hat Advanced Cluster Security (RHACS)
• Multiple vulnerabilities in Red Hat VolSync
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh 2.2
• Multiple vulnerabiltiies in Red Hat OpenShift Service Mesh Containers 2.3
• Multiple vulnerabiltiies in Red Hat OpenShift Service Mesh Containers 2.4
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.11
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.10
• Multiple vulnerabilities in Dell PowerProtect Cyber Recovery
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.12
• Multiple vulnerabilities in OpenShift sandboxed containers 1.4
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.0
• Improper privilege management in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in OpenShift Virtualization 4.12
• Multiple vulnerabilities in Red Hat Gatekeeper Operator
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in Red Hat OpenShift support for Windows Containers 6.0
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in Red Hat DevWorkspace Operator
• Multiple vulnerabilities in Red Hat VolSync 0.6
• Multiple vulnerabilities in Red Hat VolSync 0.5
• Multiple vulnerabilities in Secondary Scheduler Operator for Red Hat OpenShift
• Multiple vulnerabilities in IBM MQ Operator
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC) 1.7
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Exposure Function
• Multiple vulnerabilities in Red Hat Self Node Remediation Operator 0.5
• Multiple vulnerabilities in Migration Toolkit for Virtualization 2.4
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• IBM Storage Scale System update for systemd
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Red Hat Enterprise Linux 8.6 Extended Update Support update for systemd
• openEuler 20.03 LTS SP1 update for systemd
• openEuler 20.03 LTS SP3 update for systemd
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.11
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh Containers 2.5
• Multiple vulnerabilities in Service Telemetry Framework 1.5
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.10
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Improper privilege management in Total Storage Service Console (TSSC) / TS4500 IMC
• Multiple vulnerabilities in Dell ObjectScale
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for systemd
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Migration Toolkit for Containers 1.7
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Anolis OS update for systemd
• Anolis OS update for systemd
• SUSE update for systemd
• Juniper Session Smart Router update for third-party components