Junglewise Threat Intelligence

CVE-2025-6020: Linux-PAM privilege escalation in pam_namespace module

CVE-2025-6020 · Severity: high · CVSS 7.8 · Published 2025-06-17

Technologies: Red Hat Enterprise Linux, Debian Linux. Vendors: Red Hat, Debian.

Executive brief

A security vulnerability has been identified in a core Linux component responsible for managing user authentication and system access. This flaw allows a person who already has a standard user account on a system to gain full administrative (root) control. By exploiting how the system handles file paths, an attacker can bypass security restrictions, potentially leading to a complete takeover of the affected server or workstation.

Technical details

A flaw was discovered in the pam_namespace module of linux-pam, which is responsible for setting up polyinstantiated directories for user sessions. The module fails to properly protect against user-controlled paths, leading to a directory traversal vulnerability (CWE-22). A local attacker with low privileges can exploit this through a combination of multiple symlink attacks and race conditions during the namespace setup process. Successful exploitation allows the attacker to manipulate files outside of their restricted environment and elevate their privileges to root. Patches have been released by major distributions including Red Hat and Debian.

Affected products

  • Linux-PAM PAM (Pluggable Authentication Modules) Versions prior to 1.6.1
  • Red Hat Enterprise Linux 8, 9
  • Debian Debian Linux LTS

Timeline

  • 2025-06-17: disclosed: Initial disclosure on oss-security mailing list
  • 2025-06-17: advisory: NVD record published
  • 2025-07-01: patched: Red Hat released security updates for RHEL 8 and 9

References

Related threats