CVE-2025-6018
HIGH 14 PoCs
MEDIUM
Priority: 0.09
BB Relevance:
51/100
Published: 2025-07-23
Modified: 2026-11-04
First seen: 2026-11-04
Status: active
Attack Surface
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unprivileged local attacker (for example, a user logged in via SSH) to obtain the elevated privileges normally reserved for a physically present, "allow_active" user. The highest risk is that the attacker can then perform all allow_active yes Polkit actions, which are typically restricted to console users, potentially gaining unauthorized control over system configurations, services, or other sensitive operations.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| — | — | 0 < 1.1.8-24.71.1 |
| suse | pam-config | 1.1.8-24.71.1 |
References & Advisories (5)
Third Party Advisory
Issue Tracking
Third Party Advisory
Exploit
Third Party Advisory
Exploit
Issue Tracking
Third Party Advisory
Proof of Concept (14)
★ 12
nomi-sec