Cloudanix VulnDB

CVE-2025-1390

Medium · 6.1

CVSS

6.1

EPSS

0.2%

Published

Feb 18, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A parsing mistake in a Linux security module can accidentally give extra system permissions to ordinary user accounts instead of only the intended ones.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Privilege Gain
Component
Library
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The pam_cap.so module incorrectly treats non-@ prefixed entries in capability.conf as group names during parsing, causing unintended user accounts to receive inherited capability sets.

Why it matters to the business

Local users on affected Debian systems can obtain unintended elevated privileges, increasing risk of unauthorized access or system compromise on systems relying on capability.conf for privilege inheritance.

How an attack unfolds

An attacker creates or uses a local username that matches a capability.conf entry intended only for a specific user or group; because entries lacking the @ prefix are misparsed as groups, the PAM module grants the attacker the associated inherited capabilities upon login, enabling local privilege escalation.

How to fix it

Upgrade libcap to version 6.8.9-1 or later on Debian 13; after upgrade, review and validate entries in /etc/security/capability.conf to ensure only intended users and groups receive capabilities.

How to confirm the fix worked

Confirm libcap package version is at least 6.8.9-1; test parsing of capability.conf entries with and without @ prefix to verify correct user versus group handling; review assigned capabilities for test accounts.

Typical attack path

  1. Locate systems using /etc/security/capability.conf with pam_cap.so configured
  2. Identify entries in capability.conf that lack the @ prefix
  3. Create or assume a local account whose name matches one of those entries
  4. Authenticate to trigger pam_cap.so parsing and receive the unintended capabilities
  5. Leverage the granted capabilities to perform privileged operations

How to detect it

Inspect authentication and PAM logs for pam_cap.so activity; search for processes or sessions showing unexpected capability sets; review /etc/security/capability.conf contents and correlate with user account creation events.

  • /etc/security/capability.conf
  • pam_cap.so
  • capability.conf entries without leading @

What your security team should do

  • Apply the libcap 6.8.9-1 update to all Debian 13 systems without delay
  • Audit /etc/security/capability.conf for entries that could be misinterpreted
  • Monitor authentication logs for unexpected capability grants to non-privileged users
  • Consider disabling pam_cap.so where capability inheritance is not required

The record

The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 libcap2 0 No fix
Debian:11 libcap2 0 1:2.44-1+deb11u1
Debian:12 libcap2 0 No fix
Debian:13 libcap2 0 No fix
Mageia:9 libcap 0 2.52-5.1.mga9

Related vulnerabilities