Executive brief
AccountsService is a system service that manages user accounts on Ubuntu. A flaw in how the service launches language helper scripts allows a local user to gain root privileges by exploiting an incomplete credential drop and shell injection in the language configuration helper. An attacker can execute arbitrary code as root without requiring administrative authentication.
Technical details
The vulnerability is a compound flaw combining incomplete privilege dropping and shell injection in Ubuntu's language helper scripts. AccountsService attempts to drop privileges before executing the set-language-helper by changing effective UID/GID but leaves the real UID as 0 (root). When a non-English language is selected, the helper reads an attacker-controlled ~/.pam_environment file and passes unescaped user data into a sed command, allowing injection of sed metacharacters (the 'e' flag) to execute arbitrary shell commands. A spawned shell can then reset its effective UID to root (ruid=0) and install a setuid-root binary for subsequent privilege escalation. The attack requires local user access and one non-English language pack installed; it bypasses authentication via the default "change-own-user-data" policy that allows same-user modifications without admin approval.
Affected products
- Ubuntu AccountsService before 23.13.9-8ubuntu7 (Resolute/26.04 LTS), before 23.13.9-2ubuntu6.1 (Noble/24.04 LTS), before 22.07.5-2ubuntu1.6 (Jammy/22.04 LTS), before 0.6.55-0ubuntu12~20.04.7+esm1 (Focal/20.04 LTS), and earlier versions
Timeline
- 2026-07-21: disclosed: Public disclosure via Ubuntu Security Advisory
- 2026-07-21: patched: Fixed versions released for supported Ubuntu LTS releases