CVE-2024-6126 Cockpit: authenticated user can kill any process when enabling pam_env's user_readenv option
An authenticated user can kill arbitrary processes causing denial of service when pam_env user_readenv is enabled in Cockpit.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-6126?
CVE-2024-6126 is a low-severity denial of service vulnerability in Red Hat Enterprise Linux 10, published on 3 Jul 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when enabling the pam_env's user_readenv option, which leads to a denial of service (DoS) attack.
Weakness: CWE-400
Which versions are affected by CVE-2024-6126?
Linux distribution packages (29)
cockpit AlmaLinux:9 | All versions | 323.1-1.el9_5 |
cockpit-bridge AlmaLinux:9 | All versions | 323.1-1.el9_5 |
cockpit-doc AlmaLinux:9 | All versions | 323.1-1.el9_5 |
cockpit-packagekit AlmaLinux:9 | All versions | 323.1-1.el9_5 |
cockpit-pcp AlmaLinux:9 | All versions | 323.1-1.el9_5 |
cockpit-storaged AlmaLinux:9 | All versions | 323.1-1.el9_5 |
cockpit-system AlmaLinux:9 | All versions | 323.1-1.el9_5 |
cockpit-ws AlmaLinux:9 | All versions | 323.1-1.el9_5 |
cockpit-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:323.1-1.el9_5 |
cockpit-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:323.1-1.el9_5 |
cockpit-packagekit Red Hat:enterprise_linux:9::appstream | All versions | 0:323.1-1.el9_5 |
cockpit-pcp Red Hat:enterprise_linux:9::appstream | All versions | 0:323.1-1.el9_5 |
cockpit-storaged Red Hat:enterprise_linux:9::appstream | All versions | 0:323.1-1.el9_5 |
cockpit Red Hat:enterprise_linux:9::baseos | All versions | 0:323.1-1.el9_5 |
cockpit-bridge Red Hat:enterprise_linux:9::baseos | All versions | 0:323.1-1.el9_5 |
cockpit-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:323.1-1.el9_5 |
cockpit-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:323.1-1.el9_5 |
cockpit-doc Red Hat:enterprise_linux:9::baseos | All versions | 0:323.1-1.el9_5 |
cockpit-system Red Hat:enterprise_linux:9::baseos | All versions | 0:323.1-1.el9_5 |
cockpit-ws Red Hat:enterprise_linux:9::baseos | All versions | 0:323.1-1.el9_5 |
cockpit Rocky Linux:9 | All versions | 0:323.1-1.el9_5 |
cockpit SUSE:Linux Enterprise Micro 5.1 | All versions | 195.12-150300.10.6.1 |
cockpit SUSE:Linux Enterprise Micro 5.2 | All versions | 251.3-150300.6.3.1 |
cockpit SUSE:Linux Enterprise Micro 5.3 | All versions | 251.3-150400.8.3.1 |
cockpit SUSE:Linux Enterprise Micro 5.4 | All versions | 251.3-150400.6.7.1 |
cockpit SUSE:Linux Enterprise Micro 5.5 | All versions | 298-150500.3.6.1 |
cockpit SUSE:Package Hub 15 SP6 | All versions | 320-bp156.2.6.3 |
cockpit openSUSE:Leap 15.6 | All versions | 320-bp156.2.6.3 |
cockpit openSUSE:Tumbleweed | All versions | 320-1.1 |
How do I fix CVE-2024-6126?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-6126 being exploited?
There is no known exploitation of CVE-2024-6126 in the wild and no public exploit code.
Sources
Also known as ALSA-2024:9325, DEBIAN-CVE-2024-6126, GHSA-g6h4-j28x-38g5, MGASA-2025-0181, OESA-2024-1842, RHSA-2024:9325 and 9 more.