CVE-2025-1390: pam_cap: Fix potential configuration parsing error
Last updated 26 February 2025
Other sources
pamcap: Fix potential configuration parsing error
— Microsoft
The PAM module pamcap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.
— NVD
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1390?
CVE-2025-1390 has a high severity due to the potential for unauthorized users to gain elevated capabilities.
How do I fix CVE-2025-1390?
To fix CVE-2025-1390, ensure that only trusted group names are used in the configuration and consider applying relevant patches from the libcap maintainers.
Which versions of libcap are affected by CVE-2025-1390?
CVE-2025-1390 affects versions of libcap that improperly handle group names during configuration parsing.
What potential impacts does CVE-2025-1390 have on system security?
CVE-2025-1390 can lead to unauthorized users being granted unintended capabilities, compromising system security.
Is there a workaround for CVE-2025-1390?
As a temporary workaround for CVE-2025-1390, avoid using group names that do not start with '@' in the PAM module configurations.