CVE-2025-6020highCWE-22

CVE-2025-6020: falha de alta gravidade em linux-pam

Linux-pam: linux-pam directory traversal

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat Enterprise Linux+ Monitorar Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.8epss 0.5%
A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
linux-pamRed Hat · cert-manager operator for Red Hat OpenShift 1.16Red Hat · Compliance Operator 1Red Hat · Red Hat Discovery 2Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 10.0 Extended Update SupportRed Hat · Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update SupportRed Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat · Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat · Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRed Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRed Hat · Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat · Red Hat Insights proxy 1.5Red Hat · Red Hat OpenShift distributed tracing 3.6.0Red Hat · Red Hat OpenShift sandboxed containers 1.10Red Hat · Red Hat Web Terminal 1.11 on RHEL 9Red Hat · Red Hat Web Terminal 1.12 on RHEL 9Red Hat · RHEL-8 based Middleware ContainersRed Hat · RHOSS-1.36-RHEL-8
CVEs relacionadas — linux-pam

No mesmo produto, das mais perigosas para as menos.

CVE-2024-12085HIGHRsync: info leak via uninitialized stack contentsEPSS 8.6%CVE-2025-49796CRITICALLibxml: type confusion leads to denial of service (dos)EPSS 1.6%CVE-2025-49794CRITICALLibxml: heap use after free (uaf) leads to denial of service (dos)EPSS 0.8%CVE-2025-5914HIGHLibarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.cEPSS 0.5%CVE-2025-7425HIGHLibxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptrEPSS 0.4%CVE-2025-8941HIGHLinux-pam: incomplete fix for cve-2025-6020EPSS 0.3%