A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00032.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Redhat
  • Cert Manager
  • Confidential Compute Attestation
  • Discovery
  • Enterprise Linux
  • Enterprise Linux Eus
  • Insights Proxy
  • Openshift Compliance Operator
  • Openshift Distributed Tracing
  • Rhel Aus
  • Rhel E4s
  • Rhel Els
  • Rhel Eus
  • Rhel Tus
  • Rhosemc
  • Webterminal

No data.

Package CPE Advisory Released Date
Red Hat Enterprise Linux 7 Extended Lifecycle Support
pam-0:1.1.8-23.el7_9.1 cpe:/o:redhat:rhel_els:7 RHSA-2025:10357 2025-07-07T00:00:00Z
Red Hat Enterprise Linux 8
pam-0:1.3.1-37.el8_10 cpe:/o:redhat:enterprise_linux:8 RHSA-2025:10027 2025-07-01T00:00:00Z
Red Hat Enterprise Linux 8.2 Advanced Update Support
pam-0:1.3.1-8.el8_2.1 cpe:/o:redhat:rhel_aus:8.2 RHSA-2025:10362 2025-07-07T00:00:00Z
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
pam-0:1.3.1-14.el8_4.1 cpe:/o:redhat:rhel_aus:8.4 RHSA-2025:10361 2025-07-07T00:00:00Z
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
pam-0:1.3.1-16.el8_6.2 cpe:/o:redhat:rhel_aus:8.6 RHSA-2025:10359 2025-07-07T00:00:00Z
Red Hat Enterprise Linux 8.6 Telecommunications Update Service
pam-0:1.3.1-16.el8_6.2 cpe:/o:redhat:rhel_tus:8.6 RHSA-2025:10359 2025-07-07T00:00:00Z
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
pam-0:1.3.1-16.el8_6.2 cpe:/o:redhat:rhel_e4s:8.6 RHSA-2025:10359 2025-07-07T00:00:00Z
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
pam-0:1.3.1-26.el8_8.1 cpe:/o:redhat:rhel_tus:8.8 RHSA-2025:10358 2025-07-07T00:00:00Z
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
pam-0:1.3.1-26.el8_8.1 cpe:/o:redhat:rhel_e4s:8.8 RHSA-2025:10358 2025-07-07T00:00:00Z
Red Hat Enterprise Linux 9
pam-0:1.5.1-25.el9_6 cpe:/a:redhat:enterprise_linux:9 RHSA-2025:9526 2025-06-24T00:00:00Z
pam-0:1.5.1-25.el9_6 cpe:/o:redhat:enterprise_linux:9 RHSA-2025:9526 2025-06-24T00:00:00Z
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
pam-0:1.5.1-9.el9_0.2 cpe:/a:redhat:rhel_e4s:9.0 RHSA-2025:10354 2025-07-07T00:00:00Z
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
pam-0:1.5.1-15.el9_2.1 cpe:/a:redhat:rhel_e4s:9.2 RHSA-2025:10180 2025-07-02T00:00:00Z
Red Hat Enterprise Linux 9.4 Extended Update Support
pam-0:1.5.1-24.el9_4 cpe:/a:redhat:rhel_eus:9.4 RHSA-2025:10024 2025-07-01T00:00:00Z
Red Hat OpenShift distributed tracing 3.6.1
registry.redhat.io/rhosdt/opentelemetry-collector-rhel8:sha256:1faa5daf085b0844740653d96711b3fcfa766a77224fb523335d877b8e314b57 cpe:/a:redhat:openshift_distributed_tracing:3.6::el8 RHSA-2025:10735 2025-07-09T00:00:00Z
registry.redhat.io/rhosdt/opentelemetry-rhel8-operator:sha256:5bb83d0b9387f51291c3977d37aab8a19e978a7dccf3d72cae0dabb66bd26df4 cpe:/a:redhat:openshift_distributed_tracing:3.6::el8 RHSA-2025:10735 2025-07-09T00:00:00Z
registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8:sha256:f49a121a3d0ec81f510680cd47c552f82c48889f28d3f14037c582636085410a cpe:/a:redhat:openshift_distributed_tracing:3.6::el8 RHSA-2025:10735 2025-07-09T00:00:00Z

No data.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4306-1 pam security update
EUVD EUVD EUVD-2025-19056 A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.
Ubuntu USN Ubuntu USN USN-7580-1 PAM vulnerability
Fixes

Solution

No solution given by the vendor.

Workaround

Disable the `pam_namespace` module if it is not essential for your environment, or carefully review and configure it to avoid operating on any directories or paths that can be influenced or controlled by unprivileged users, such as user home directories or world-writable locations like `/tmp`.

References
Link Providers
http://www.openwall.com/lists/oss-security/2025/06/17/1 cve-icon
https://access.redhat.com/errata/RHSA-2025:10024 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10027 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10180 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10354 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10357 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10358 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10359 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10361 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10362 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10735 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:10823 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:11386 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:11487 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:14557 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:15099 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:15709 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:15827 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:15828 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:16524 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:17181 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:18219 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:20181 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:21885 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:22019 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:9526 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2025-6020 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2372512 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2025/09/msg00021.html cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-6020 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-6020 cve-icon
History

Tue, 25 Nov 2025 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
CPEs cpe:/o:redhat:enterprise_linux_eus:10.0
Vendors & Products Redhat enterprise Linux Eus
References

Thu, 20 Nov 2025 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Compliance Operator
CPEs cpe:/a:redhat:openshift_compliance_operator:1::el9
Vendors & Products Redhat openshift Compliance Operator
References

Tue, 11 Nov 2025 16:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.1
References

Thu, 06 Nov 2025 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat insights Proxy
CPEs cpe:/a:redhat:insights_proxy:1.5::el9
Vendors & Products Redhat insights Proxy
References

Mon, 03 Nov 2025 19:30:00 +0000

Type Values Removed Values Added
References

Thu, 16 Oct 2025 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat cert Manager
CPEs cpe:/a:redhat:cert_manager:1.16::el9
Vendors & Products Redhat cert Manager
References

Tue, 14 Oct 2025 15:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10

Wed, 08 Oct 2025 14:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:rhivos:1
Vendors & Products Redhat rhivos

Fri, 03 Oct 2025 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhivos
CPEs cpe:/o:redhat:rhivos:1
Vendors & Products Redhat rhivos

Tue, 23 Sep 2025 19:45:00 +0000

Type Values Removed Values Added
References

Mon, 15 Sep 2025 18:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:webterminal:1.12::el9
References

Mon, 15 Sep 2025 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat webterminal
CPEs cpe:/a:redhat:webterminal:1.11::el9
Vendors & Products Redhat webterminal
References

Thu, 11 Sep 2025 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat confidential Compute Attestation
CPEs cpe:/a:redhat:confidential_compute_attestation:1.10::el9
Vendors & Products Redhat confidential Compute Attestation
References

Wed, 03 Sep 2025 03:15:00 +0000

Type Values Removed Values Added
References

Tue, 26 Aug 2025 03:15:00 +0000

Type Values Removed Values Added
References

Mon, 21 Jul 2025 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat discovery
CPEs cpe:/a:redhat:discovery:2::el9
Vendors & Products Redhat discovery
References

Thu, 17 Jul 2025 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhosemc
CPEs cpe:/a:redhat:rhosemc:1.0::el8
Vendors & Products Redhat rhosemc
References

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00023}

 epss

{'score': 0.00018}

Thu, 10 Jul 2025 20:00:00 +0000

Type Values Removed Values Added
References

Wed, 09 Jul 2025 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Distributed Tracing
CPEs cpe:/a:redhat:openshift_distributed_tracing:3.6::el8
Vendors & Products Redhat openshift Distributed Tracing
References

Mon, 07 Jul 2025 15:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_e4s:9.0
cpe:/o:redhat:rhel_aus:8.2
cpe:/o:redhat:rhel_aus:8.4
cpe:/o:redhat:rhel_aus:8.6
cpe:/o:redhat:rhel_e4s:8.6
cpe:/o:redhat:rhel_e4s:8.8
cpe:/o:redhat:rhel_tus:8.6
cpe:/o:redhat:rhel_tus:8.8

Mon, 07 Jul 2025 08:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel Els
Redhat rhel Tus
CPEs cpe:/o:redhat:enterprise_linux:7 cpe:/a:redhat:rhel_e4s:9.0::appstream
cpe:/o:redhat:rhel_aus:8.2::baseos
cpe:/o:redhat:rhel_aus:8.4::baseos
cpe:/o:redhat:rhel_aus:8.6::baseos
cpe:/o:redhat:rhel_e4s:8.6::baseos
cpe:/o:redhat:rhel_e4s:8.8::baseos
cpe:/o:redhat:rhel_e4s:9.0::baseos
cpe:/o:redhat:rhel_els:7
cpe:/o:redhat:rhel_tus:8.6::baseos
cpe:/o:redhat:rhel_tus:8.8::baseos
Vendors & Products Redhat rhel Aus
Redhat rhel Els
Redhat rhel Tus
References

Wed, 02 Jul 2025 14:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_e4s:9.2

Wed, 02 Jul 2025 08:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel E4s
CPEs cpe:/a:redhat:rhel_e4s:9.2::appstream
cpe:/o:redhat:rhel_e4s:9.2::baseos
Vendors & Products Redhat rhel E4s
References

Wed, 02 Jul 2025 02:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_eus:9.4
cpe:/o:redhat:enterprise_linux:8

Tue, 01 Jul 2025 20:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:8::baseos
References

Tue, 01 Jul 2025 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:9.4::appstream
cpe:/o:redhat:rhel_eus:9.4::baseos
Vendors & Products Redhat rhel Eus
References

Wed, 25 Jun 2025 02:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:9
cpe:/o:redhat:enterprise_linux:9

Tue, 24 Jun 2025 18:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/o:redhat:enterprise_linux:9::baseos
References

Wed, 18 Jun 2025 15:00:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 17 Jun 2025 16:30:00 +0000

Type Values Removed Values Added
References

Tue, 17 Jun 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 17 Jun 2025 13:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.
Title Linux-pam: linux-pam directory traversal
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-22
CPEs cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2025-11-25T10:09:57.404Z

Reserved: 2025-06-11T22:38:25.643Z

Link: CVE-2025-6020

cve-icon Vulnrichment

Updated: 2025-11-03T18:13:57.307Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-06-17T13:15:21.660

Modified: 2025-11-25T11:15:48.903

Link: CVE-2025-6020

cve-icon Redhat

Severity : Important

Publid Date: 2025-06-17T00:00:00Z

Links: CVE-2025-6020 - Bugzilla

cve-icon OpenCVE Enrichment

No data.