An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.

accountsservice no longer drops permissions when writting .pamenvironment

A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the accounts-daemon process.

A flaw was found in accountsservice. The systemd-homed handler for the SetIconFile D-Bus method (userchangeiconfilehomedauthorizedcb) opens a caller-supplied path as root without the path validation and privilege drop used by the classic handler. A local user with a systemd-homed-managed account can cause accounts-daemon to read arbitrary files (for example /etc/shadow) and store their contents as the user avatar. This issue affects accountsservice versions with homed avatar support (approximately 25.34.76 through 26.13.3) and is fixed in 26.26.9 by reading avatar files as the calling user.