CVE-2015-8325

What it actually does

Allows a local user to inject arbitrary environment variables (such as LD_PRELOAD) into the /bin/login process via a crafted .pam_environment file when UseLogin is enabled and PAM is configured to read user home directory files, resulting in privilege escalation to root.

Why it matters to the business

An attacker with existing low-privileged access can obtain full system control, potentially leading to data breaches, service disruption, or persistent unauthorized access in environments using the affected OpenSSH configuration; the issue appears in older GitLab Bitnami packages, increasing exposure for organizations that have not updated those deployments.

How an attack unfolds

An attacker with local shell access creates a malicious .pam_environment file in their home directory containing an LD_PRELOAD variable pointing to a library that executes attacker-controlled code, then triggers a login session through the vulnerable sshd path that invokes /bin/login under PAM, causing the preloaded library to run with elevated privileges.

How to fix it

Upgrade GitLab Bitnami to version 13.10.5 or later, which includes a patched OpenSSH component; disable UseLogin in sshd_config and configure PAM to ignore user .pam_environment files if immediate upgrade is not possible.

How to confirm the fix worked

Confirm the installed OpenSSH version is newer than 7.2p2 and that UseLogin is set to no in sshd_config; verify the GitLab Bitnami package version meets or exceeds 13.10.5 and test that PAM does not load environment files from user home directories.

Typical attack path

1. Obtain initial local user account on the target system
2. Write a crafted .pam_environment file containing LD_PRELOAD or similar variables
3. Initiate an SSH connection or login that invokes the UseLogin code path
4. Trigger PAM environment loading which passes the variable to /bin/login
5. Execute arbitrary code with root privileges via the preloaded library

How to detect it

Search authentication logs and PAM-related logs for unusual environment variable injections during login sessions; examine user home directories for unexpected .pam_environment files containing LD_PRELOAD or similar variables; review process execution logs for /bin/login spawning with unexpected library loads.

• .pam_environment
• LD_PRELOAD
• UseLogin yes

What your security team should do

• Immediately upgrade all GitLab Bitnami instances to 13.10.5 or newer
• Audit sshd_config across the environment and set UseLogin to no
• Review PAM configuration to prevent reading of user-writable environment files
• Monitor for any remaining systems running OpenSSH 7.2p2 or earlier