pam_cap: Fix potential configuration parsing error
The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.
CVE-2025-1390
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-1390
Anolis OS
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/libs/libcap/libcap.git/",
"vendor": "OpenAnolis",
"modules": [
"pam_cap"
],
"product": "Anolis OS",
"versions": [
{
"status": "affected",
"version": "2.73;0",
"versionType": "custom"
}
],
"platforms": [
"Linux",
"x86",
"ARM"
],
"packageName": "libcap",
"programFiles": [
"pam_cap/pam_cap.c"
],
"collectionURL": "http://sites.google.com/site/fullycapable/",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2025-1390
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #26894 · Revision 1
- Added to Heist Feed
- Publisher date