CVE-2023-26604

systemd is a system and service manager that runs as PID 1 and starts the rest of the system.

Security Fix(es):

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.(CVE-2023-26604)

systemd is a system and service manager that runs as PID 1 and starts the rest of the system.

Security Fix(es):

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.(CVE-2023-26604)

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es):

• systemd: privilege escalation via the less pager (CVE-2023-26604)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• systemd-pstore crashes when attempting to move standalone files out of /sys/fs/pstore (BZ#2190153)

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es):

• systemd: privilege escalation via the less pager (CVE-2023-26604)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• systemd-pstore crashes when attempting to move standalone files out of /sys/fs/pstore (BZ#2190153)

• SECURITY UPDATE: buffer overrun vulnerability in format_timespan()
  • debian/patches/CVE-2022-3821.patch: fix buffer-over-run
  • CVE-2022-3821
• SECURITY UPDATE: a local privelege escalation for some sudo configs was not blocked adequately
  • debian/patches/CVE-2023-26604.patch: use only less as a pager and restrict its functionality (e.g stop running external shell) unless environment variable SYSTEMD_PAGERSECURE is defined
  • CVE-2023-26604

• CVE-2023-26604: prevent a priveledge escalation in a pager sub-process
• test_login was updated

• CVE-2023-26604: prevent a priveledge escalation in a pager sub-process
• test_login was updated

• SECURITY UPDATE: local privilege escalation for some Sudo configurations
  • debian/patches/CVE-2023-26604.patch: set LESSSECURE to 1
  • CVE-2023-26604
• test issue: udev-test.pl is stopped by a timeout in a virtual environment
  • debian/patches/fix-udev-test.patch: skip this test in some cases

• CVE-2023-26604: use only less as a pager and restrict its functionality (e.g stop running external shell) unless environment variable SYSTEMD_PAGERSECURE is defined

• Moved tuxcare patches from 219-78.7.tuxcare.els1
• CVE-2023-26604: use only less as a pager and restrict its functionality (e.g stop running external shell) unless environment variable SYSTEMD_PAGERSECURE is defined

• SECURITY UPDATE: systemctl may pass arbitrary shell commands from a pager like more(1) that does not honor LESSSECURE, allowing privilege escalation under sudo.
  • debian/patches/CVE-2023-26604.patch: set LESSSECURE=1 when invoking a pager, rename to SYSTEMD_PAGERSECURE, gate insecure pagers behind sd_pid_get_owner_uid()/euid check, skip non-"less" pagers in secure mode, and read the envvar via secure_getenv(). Squash of upstream commits 612ebf6c91, 0a42426d79, and b8f736b30e (src/shared/pager.c only; man-page hunks dropped).
  • CVE-2023-26604

This update for systemd fixes the following issues:

• CVE-2023-26604: Fixed a privilege escalation via the less pager. (bsc#1208958)

This update for systemd fixes the following issues:

• CVE-2023-26604: Fixed a privilege escalation via the less pager. (bsc#1208958)
• CVE-2022-4415: Fixed systemd-coredump that did not respect the fs.suid_dumpable kernel setting (bsc#1205000).
• CVE-2022-3821: Fixed buffer overrun in format_timespan() function (bsc#1204968).

Bug fixes:

• Restrict cpu rule to x86_64, and also update the rule files to make use of the 'CONST{arch}' syntax (bsc#1204423).
• Fixed 'systemd --user' call pam_loginuid when creating [email protected] (bsc#1198507).
• Fixed 'systemd-detect-virt' refine hypervisor detection (bsc#1197244).
• Fixed 'udev' 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529).
• Fixed 'man' tweak description of auto/noauto (bsc#1191502).

This update for systemd fixes the following issues:

• CVE-2025-4598: Race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump (bsc#1243935).
• CVE-2023-26604: Privilege escalation via the less pager (bsc#1208958).
• CVE-2022-4415: systemd-coredump was not respecting fs.suid_dumpable kernel setting (bsc#1205000).

Other bugfixes:

• clarify passno and noauto combination in /etc/fstab (bsc#1211725)
• handle -EINTR return from bus_poll() (bsc#1215241)
• /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)