CVE-2025-6018

Katalog CVE

CVSS 7.8 · High EPSS 1,1%

Kerentanan Incorrect Authorization pada suse pam-config. Skor CVSS 3.1 7.8 (High) menurut redhat.com.

Deskripsi (NVD)

A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unprivileged local attacker (for example, a user logged in via SSH) to obtain the elevated privileges normally reserved for a physically present, "allow_active" user. The highest risk is that the attacker can then perform all allow_active yes Polkit actions, which are typically restricted to console users, potentially gaining unauthorized control over system configurations, services, or other sensitive operations.

Rincian

Terbit di NVD

23 Juli 2025

Terakhir diubah

30 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber redhat.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2025-6018 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2372693 issue tracking · advisory pihak ketiga
• https://bugzilla.suse.com/show_bug.cgi?id=1243226 exploit · advisory pihak ketiga
• https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt exploit · issue tracking · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2025/08/28/4