CVE-2023-26604: debian debian_linux Improper Privilege Management

Vulnerability summary

CVE-2023-26604 is a high (CVSS 7.8) Improper Privilege Management vulnerability in debian debian_linux. EPSS estimates a 1.05% chance of exploitation in the next 30 days, higher than 63.7% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 03-03-2023
   PublishedVulnerability first disclosed.
2. 14-10-2026
   Last modifiedVulnerability information updated.

Description

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.