CVE-2022-1804

What it actually does

The service fails to drop privileges before writing to a user's .pam_environment file, allowing a local attacker to potentially write content to files with elevated permissions.

Why it matters to the business

Local users could gain higher privileges on the system, potentially accessing restricted data or performing unauthorized actions.

How an attack unfolds

An attacker with local access manipulates the account service interaction to cause it to write arbitrary content to sensitive files without proper permission checks.

How to fix it

Update accountsservice to a version that correctly drops permissions during .pam_environment writes.

How to confirm the fix worked

Inspect accountsservice source or package version history to confirm the permission-dropping logic is restored and test PAM environment handling under non-root execution contexts.

Typical attack path

1. Obtain local user access on the affected system
2. Trigger accountsservice to handle a PAM environment write operation
3. Exploit the failure to drop permissions to modify privileged files
4. Leverage modified files to escalate privileges further

How to detect it

Examine system and PAM logs for accountsservice write operations to .pam_environment files and correlate with unexpected file ownership or permission changes in user directories.

What your security team should do

• Apply the latest accountsservice package updates across all affected systems
• Audit local user accounts and PAM configurations for unnecessary privileges
• Enable enhanced logging for accountsservice and PAM-related file operations