Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Red Hat Enterprise Linux allows local users to gain root access

CVE-2025-6020 · published 1 year ago
Summary

The pam_namespace component in Red Hat Enterprise Linux versions 7, 8, 8.2, and 10 can be tricked by a user into following malicious shortcuts (symlinks) and timing attacks. This can let a regular user obtain full administrative rights on the system. Apply the latest security updates from Red Hat to fix the problem.

What to do
  • Update debian rootio-pam to version 1.4.0-9+deb11u1.root.io.7.
  • Update canonical pam to version 1.4.0-11ubuntu2.6.
  • Update canonical pam to version 1.5.3-5ubuntu5.4.
  • Update canonical pam to version 1.5.3-7ubuntu6.
  • Update debian pam to version 1.4.0-9+deb11u2.
  • Update debian pam to version 1.5.2-6+deb12u2.
  • Update debian pam to version 1.7.0-5.
Affected software
Ecosystem VendorProductAffected versions
– red hat red hat enterprise linux 10 All versions
– red hat red hat enterprise linux 10.0 extended update support All versions
– red hat red hat enterprise linux 7 extended lifecycle support All versions
– red hat red hat enterprise linux 8 All versions
– red hat red hat enterprise linux 8.2 advanced update support All versions
– red hat red hat enterprise linux 8.4 advanced mission critical update support All versions
– red hat red hat enterprise linux 8.6 advanced mission critical update support All versions
– red hat red hat enterprise linux 8.6 telecommunications update service All versions
– red hat red hat enterprise linux 8.6 update services for sap solutions All versions
– red hat red hat enterprise linux 8.8 telecommunications update service All versions
– red hat red hat enterprise linux 8.8 update services for sap solutions All versions
– red hat red hat enterprise linux 9 All versions
– red hat red hat enterprise linux 9.0 update services for sap solutions All versions
– red hat red hat enterprise linux 9.2 update services for sap solutions All versions
– red hat red hat enterprise linux 9.4 extended update support All versions
– red hat red hat web terminal 1.11 on rhel 9 All versions
– red hat red hat web terminal 1.12 on rhel 9 All versions
– red hat rhel-8 based middleware containers All versions
– red hat rhoss-1.36-rhel-8 All versions
– red hat cert-manager operator for red hat openshift 1.16 All versions
– red hat compliance operator 1 All versions
– red hat red hat discovery 2 All versions
– red hat red hat insights proxy 1.5 All versions
– red hat red hat openshift distributed tracing 3.6.0 All versions
– red hat red hat openshift sandboxed containers 1.1 All versions
– red hat openshift compliance operator 1 All versions
– red hat red hat openshift distributed tracing 3.6.1 All versions
Root:Debian:11 debian rootio-pam < 1.4.0-9+deb11u1.root.io.7
Fix: upgrade to 1.4.0-9+deb11u1.root.io.7
Ubuntu:Pro:14.04:LTS canonical pam All versions
Ubuntu:Pro:16.04:LTS canonical pam All versions
Ubuntu:Pro:18.04:LTS canonical pam All versions
Ubuntu:Pro:20.04:LTS canonical pam All versions
Ubuntu:22.04:LTS canonical pam < 1.4.0-11ubuntu2.6
Fix: upgrade to 1.4.0-11ubuntu2.6
Ubuntu:24.04:LTS canonical pam < 1.5.3-5ubuntu5.4
Fix: upgrade to 1.5.3-5ubuntu5.4
Ubuntu:25.10 canonical pam < 1.5.3-7ubuntu6
Fix: upgrade to 1.5.3-7ubuntu6
Debian:11 debian pam < 1.4.0-9+deb11u2
Fix: upgrade to 1.4.0-9+deb11u2
Debian:12 debian pam < 1.5.2-6+deb12u2
Fix: upgrade to 1.5.2-6+deb12u2
Debian:13 debian pam < 1.7.0-5
Fix: upgrade to 1.7.0-5
Debian:14 debian pam < 1.7.0-5
Fix: upgrade to 1.7.0-5
– red hat red hat openshift sandboxed containers 1.10 All versions
Original advisory text
Linux-pam: linux-pam directory traversal
A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published17 Jun 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-6020 · NVD
CVE-2025-6020 · MITRE
ROOT-OS-DEBIAN-11-CVE-2025-6020 · OSV
CVE-2025-6020 · OSV
DEBIAN-CVE-2025-6020 · OSV
UBUNTU-CVE-2025-6020 · OSV
GHSA-f9p8-gjr4-j9gx · GHSA
Track software like this
Free during beta