CVE-2025-6018: SUSE and Red Hat PAM local privilege escalation in pam-config

CVE-2025-6018 · Severity: high · CVSS 7.8 · Published 2025-07-23

A security vulnerability has been identified in the authentication system of several Linux distributions, including SUSE and Red Hat. This flaw allows a local user, such as someone logged in remotely via SSH, to trick the system into believing they are physically present at the computer console. By doing so, the attacker can bypass security restrictions and perform sensitive administrative actions—like rebooting the system or changing configurations—that are normally reserved only for users with physical access to the machine.

Technologies: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Red Hat, Suse.

Quick answers

Is CVE-2025-6018 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-6018 being exploited in the wild.
How severe is CVE-2025-6018?
High severity, with a CVSS score of 7.8, published 23 July 2025.
Which products and versions are affected?
Suse openSUSE Leap 15 All versions prior to pam-1.1.8-24.71.1; SUSE Linux Enterprise 15 All versions prior to pam-1.1.8-24.71.1.
Is there a fix for CVE-2025-6018?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-6018 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2025-6018?
Check whether you run Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Local Privilege Escalation (LPE) vulnerability exists in the PAM (Pluggable Authentication Modules) configuration of SUSE 15 and other Linux distributions. The root cause is the 'pam_env' module reading a user's '~/.pam_environment' file by default during the 'auth' stack, before 'pam_systemd' is called in the 'session' stack. An unprivileged attacker can define environment variables like 'XDG_SEAT=seat0' and 'XDG_VTNR=1' in their local environment file. When 'pam_systemd' later retrieves these variables via 'pam_getenv()', it incorrectly identifies the remote session as a local, active console session. This grants the attacker 'allow_active' Polkit privileges, enabling them to execute restricted system actions. Patches are available for affected SUSE versions (e.g., pam-1.1.8-24.71.1).

Affected products

  • SUSE SUSE Linux Enterprise 15 All versions prior to pam-1.1.8-24.71.1
  • SUSE openSUSE Leap 15 All versions prior to pam-1.1.8-24.71.1
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9

Timeline

  • 2025-05-15: other: Vulnerability reported to SUSE
  • 2025-06-17: disclosed: Public disclosure via oss-security mailing list
  • 2025-07-23: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.