ALSA-2023:3837 - Moderate: systemd security and bug fix update
Summary
ALSA-2023:3837: Moderate: systemd security and bug fix update. Affects systemd versions < 239-74.el8_8.2. Fixed in 239-74.el8_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The systemd package is a system and service manager for Linux that is compatible with SysV and LSB init scripts. It provides parallelism capabilities, socket and D-Bus activation for starting services, on-demand starting of daemons, process tracking using Linux cgroups, snapshotting and restoring of system state, management of mount and automount points, and transactional dependency-based service control logic. It can also be used as a drop-in replacement for sysvinit.
Vulnerability Detail
This vulnerability (CVE-2023-26604) in systemd allows for privilege escalation via the less pager. An attacker with local access can exploit this vulnerability to gain elevated privileges on the system. The impact of this vulnerability can be severe, as it allows an attacker to execute arbitrary code with root privileges.
How To Fix
Minimum fixed version
239-74.el8_8.2
This is the first release that contains the fix.
sudo dnf update systemdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update to protect the system.
Conclusion
The systemd package has a vulnerability that allows for privilege escalation. It is crucial to update the package to the recommended version to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for systemd →
FAQ
systemd is a system and service manager for Linux that provides various features such as parallelism capabilities, process tracking, and transactional dependency-based service control logic.
This vulnerability allows an attacker to escalate privileges and execute arbitrary code with root privileges, potentially compromising the entire system.
To fix this vulnerability, update the systemd package to version 239-74.el8_8.2 or later.
No, there is no known workaround for this vulnerability. It is crucial to apply the security update.
You can find more information about this vulnerability in the CVE page listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for systemd.
