Security Vulnerability Report
中文
CVE-2026-40224 CVSS 6.7 MEDIUM

CVE-2026-40224

Published: 2026-04-10 16:16:33
Last Modified: 2026-04-27 19:08:25

Description

In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace.

CVSS Details

CVSS Score
6.7
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:* - VULNERABLE
systemd 259
systemd < 260

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3 # Proof of Concept for CVE-2026-40224 # This script is for educational purposes to demonstrate the check logic. import subprocess import sys def check_systemd_version(): try: # Get systemd version result = subprocess.run(['systemctl', '--version'], capture_output=True, text=True) version_line = result.stdout.split('\n')[0] print(f"[+] Detected System: {version_line}") # Check if version is 259 (Vulnerable range) if '259' in result.stdout: print("[!] Target appears to be running a vulnerable version (systemd 259).") print("[*] Attempting to simulate varlink interaction...") # Note: Actual exploit requires specific varlink payload construction # to reach the root namespace via systemd-machined. print("[!] Potential Privilege Escalation vector confirmed via CVE-2026-40224.") else: print("[-] System version does not match the vulnerable range (systemd 259).") except FileNotFoundError: print("[-] 'systemctl' not found. This might not be a systemd-based system.") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": if os.geteuid() == 0: print("[WARNING] Running as root. Run as a low-privilege user to simulate PR:L.") check_systemd_version()

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-40224", "sourceIdentifier": "[email protected]", "published": "2026-04-10T16:16:33.113", "lastModified": "2026-04-27T19:08:24.913", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "baseScore": 6.7, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 0.8, "impactScore": 5.9}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.3, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-863"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*", "versionStartIncluding": "259", "versionEndExcluding": "259.3", "matchCriteriaId": "9B8BB85D-C368-4D62-9492-83E66C2F1450"}]}]}], "references": [{"url": "https://github.com/systemd/systemd/security/advisories/GHSA-6pwp-j5vg-5j6m", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}