GHSA-f9p8-gjr4-j9gx: Linux-pam: linux-pam directory traversal

Published Jun 17, 2025

Updated

A flaw was found in linux-pam. The module pamnamespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

Affected Software

1 affected component

Linux-PAM Linux-PAM

Event History

Jun 17, 2025

CVE Published

via OSV·12:44 PM

Data Sourced

via OSV·12:44 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Can this be exploited remotely?

The reported attack vector is local. An attacker needs local access and low-level privileges; no user interaction is required.

Which component must be in use for this issue to apply?

The issue is in the pam_namespace module of Linux-PAM. The reported condition involves that module accessing user-controlled paths without adequate protection.

What does an attacker need to do to obtain root privileges?

The attacker must exploit multiple symlink attacks and race conditions involving user-controlled paths used by pam_namespace. Successful exploitation can result in privilege escalation to root.

GHSA-f9p8-gjr4-j9gx: Linux-pam: linux-pam directory traversal

Affected Software

Event History

Frequently Asked Questions

Can this be exploited remotely?

Which component must be in use for this issue to apply?

What does an attacker need to do to obtain root privileges?

Company

Resources

Contact

Frequently Asked Questions

Can this be exploited remotely?

Which component must be in use for this issue to apply?

What does an attacker need to do to obtain root privileges?