Description
systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | systemd | 247.1-2 | — |
| Debian 13 | systemd | 247.1-2 | — |
| Debian 12 | systemd | 247.1-2 | — |
| Debian 10 | systemd | 241-7~deb10u9 | DLA-3377-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | systemd | No fix yet | — |
| Ubuntu Pro 18.04 LTS | systemd | No fix yet | — |
| Ubuntu Pro 16.04 LTS | systemd | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | systemd | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | systemd +7 | 239-74.el8_8.2 | RHSA-2023:3837 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.6 EUS | systemd +7 | 239-58.el8_6.13 | RHSA-2024:1105 |
| RHEL 7 ELS | systemd +9 | 219-78.el7_9.11 | RHSA-2024:7705 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | systemd +7 | 239-74.el8_8.2 | ALSA-2023:3837 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | systemd | 239-74.el8_8.2 | RLSA-2023:3837 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | systemd | 246.16-150300.7.60.1 | SUSE-SU-2025:02019-1 |
| SLES 12 SP5 | systemd | 228-157.52.1 | SUSE-SU-2023:1622-1 |
| SLES 12 SP4 | systemd | 228-150.108.2 | SUSE-SU-2023:1776-1 |
| SLES 12 SP2 | systemd | 228-150.108.2 | SUSE-SU-2023:1776-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | systemd | 246.16-150300.7.60.1 | SUSE-SU-2025:02019-1 |
| SLES for SAP 12 SP5 | systemd | 228-157.52.1 | SUSE-SU-2023:1622-1 |
| SLES for SAP 12 SP4 | systemd | 228-150.108.2 | SUSE-SU-2023:1776-1 |
| SLE Micro 5.2 | systemd | 246.16-150300.7.60.1 | SUSE-SU-2025:02019-1 |
| SLE Micro 5.1 | systemd | 246.16-150300.7.60.1 | SUSE-SU-2025:02019-1 |
| SLE HPC 15 SP3 | systemd | 246.16-150300.7.60.1 | SUSE-SU-2025:02019-1 |
| SUSE OpenStack Cloud Crowbar 9 | systemd | 228-150.108.2 | SUSE-SU-2023:1776-1 |
| SUSE OpenStack Cloud 9 | systemd | 228-150.108.2 | SUSE-SU-2023:1776-1 |
| SUSE Enterprise Storage 7.1 | systemd | 246.16-150300.7.60.1 | SUSE-SU-2025:02019-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | systemd +9 | 219-78.amzn2.0.22 | ALAS2-2023-2004 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | systemd +7 | 239-74.0.4.el8_8.2 | ELSA-2023-3837 |
| Oracle Linux 7 | systemd +9 | 219-78.0.17.el7_9.9 | ELSA-2024-7705 |
Advisories 17
- ALSA-2023:3837 Moderate: systemd security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- RHSA-2024:7705 Red Hat Security Advisory: systemd security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2024:1105 Red Hat Security Advisory: systemd security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2023:3837 Red Hat Security Advisory: systemd security and bug fix update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- DLA-3377-1 systemd - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2023:3837 Moderate: systemd security and bug fix update Rocky Linux Security Advisories · Feb 5, 2026
- SUSE-SU-2025:02019-1 Security update for systemd SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:1776-1 Security update for systemd SUSE / openSUSE Security Updates · Feb 4, 2026
- ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
- WID-SEC-2023-0571 systemd: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Jun 19, 2025
- SUSE-SU-2023:1622-1 Security update for systemd SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2024-7705 Moderate: systemd security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 9, 2024
- WID-SEC-2023-2679 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
- ELSA-2023-3837 Moderate: systemd security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 20, 2023
- ALAS2-2023-2004 Important: systemd security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 4, 2023
References
- https://medium.com/%40zenmoviefornotification/saidov-maxim-cve-2023-26604-c1232a526ba7
- https://github.com/systemd/systemd/blob/main/NEWS#L4335-L4340
- https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-2-insecure-functionality/
- [debian-lts-announce] 20230331 [SECURITY] [DLA 3377-1] systemd security update mailing-list
- https://security.netapp.com/advisory/ntap-20230505-0009/
- http://packetstormsecurity.com/files/174130/systemd-246-Local-Root-Privilege-Escalation.html