Junglewise Threat Intelligence

CVE-2025-6018: SUSE and Red Hat PAM local privilege escalation in pam-config

CVE-2025-6018 · Severity: high · CVSS 7.8 · Published 2025-07-23

Technologies: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9. Vendors: Red Hat, Suse.

Executive brief

A security vulnerability has been identified in the authentication system of several Linux distributions, including SUSE and Red Hat. This flaw allows a local user, such as someone logged in remotely via SSH, to trick the system into believing they are physically present at the computer console. By doing so, the attacker can bypass security restrictions and perform sensitive administrative actions—like rebooting the system or changing configurations—that are normally reserved only for users with physical access to the machine.

Technical details

A Local Privilege Escalation (LPE) vulnerability exists in the PAM (Pluggable Authentication Modules) configuration of SUSE 15 and other Linux distributions. The root cause is the 'pam_env' module reading a user's '~/.pam_environment' file by default during the 'auth' stack, before 'pam_systemd' is called in the 'session' stack. An unprivileged attacker can define environment variables like 'XDG_SEAT=seat0' and 'XDG_VTNR=1' in their local environment file. When 'pam_systemd' later retrieves these variables via 'pam_getenv()', it incorrectly identifies the remote session as a local, active console session. This grants the attacker 'allow_active' Polkit privileges, enabling them to execute restricted system actions. Patches are available for affected SUSE versions (e.g., pam-1.1.8-24.71.1).

Affected products

  • SUSE SUSE Linux Enterprise 15 All versions prior to pam-1.1.8-24.71.1
  • SUSE openSUSE Leap 15 All versions prior to pam-1.1.8-24.71.1
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9

Timeline

  • 2025-05-15: other: Vulnerability reported to SUSE
  • 2025-06-17: disclosed: Public disclosure via oss-security mailing list
  • 2025-07-23: advisory: NVD publication date

References

Related threats