CVE-2024-6126

What it actually does

An authenticated local user can leverage the pam_env module's user_readenv option to kill arbitrary processes on the system, resulting in denial of service.

Why it matters to the business

Disruption of critical services and processes, leading to system instability and potential downtime for administrative operations managed through cockpit.

How an attack unfolds

An attacker with local authenticated access to a system using cockpit enables or abuses the user_readenv option in pam_env to inject environment variables that trigger termination of any process, achieving denial of service without requiring elevated privileges beyond login.

How to fix it

Disable the user_readenv option in pam_env configuration files such as /etc/security/pam_env.conf and review cockpit-related PAM setups; apply any available package updates for cockpit to address the flaw.

How to confirm the fix worked

Inspect PAM configuration files for the presence of user_readenv=1 or similar settings, verify process kill permissions under authenticated sessions, and confirm no unauthorized process termination occurs during testing.

Typical attack path

1. Obtain local authenticated access to the target system
2. Access or modify pam configuration to enable user_readenv in pam_env
3. Interact with cockpit to trigger the environment variable processing
4. Kill targeted processes to cause denial of service

How to detect it

Review system and PAM logs such as /var/log/auth.log or /var/log/secure for entries related to pam_env processing, and check process accounting or audit logs for unexpected terminations of critical services initiated by cockpit sessions.

What your security team should do

• Audit all systems using cockpit for pam_env user_readenv settings
• Restrict pam_env configurations to prevent user-controlled environment variables
• Monitor authentication and process management logs for anomalies
• Apply cockpit updates as they become available in distributions