CVE-2025-6018 Pam-config: lpe from unprivileged to allow_active in pam
An unprivileged local attacker can escalate privileges to allow_active status, bypassing Polkit restrictions intended for console users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-6018?
CVE-2025-6018 is a high-severity vulnerability in Red Hat Enterprise Linux 7, published on 23 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unprivileged local attacker (for example, a user logged in via SSH) to obtain the elevated privileges normally reserved for a physically present, "allow_active" user. The highest risk is that the attacker can then perform all allow_active yes Polkit actions, which are typically restricted to console users, potentially gaining unauthorized control over system configurations, services, or other sensitive operations.
Weakness: CWE-863
Which versions are affected by CVE-2025-6018?
It affects 1 product.
Linux distribution packages (40)
gdm SUSE:Enterprise Storage 7.1 | All versions | 3.34.1-150200.8.26.1 |
pam-config SUSE:Enterprise Storage 7.1 | All versions | 1.1-150200.3.14.1 |
pam_pkcs11 SUSE:Enterprise Storage 7.1 | All versions | 0.6.10-150100.3.11.1 |
gdm SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 3.34.1-150200.8.26.1 |
pam-config SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 1.1-150200.3.14.1 |
pam_pkcs11 SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 0.6.10-150100.3.11.1 |
gdm SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 41.3-150400.4.14.1 |
pam-config SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 1.1-150200.3.14.1 |
pam_pkcs11 SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 0.6.10-150100.3.11.1 |
gdm SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 41.3-150400.4.14.1 |
pam-config SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 1.1-150200.3.14.1 |
pam_pkcs11 SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 0.6.10-150100.3.11.1 |
gdm SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 41.3-150400.4.14.1 |
pam-config SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 1.1-150200.3.14.1 |
pam_pkcs11 SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 0.6.10-150100.3.11.1 |
gdm SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 41.3-150400.4.14.1 |
pam-config SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 1.1-150200.3.14.1 |
pam_pkcs11 SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 0.6.10-150100.3.11.1 |
pam-config SUSE:Linux Enterprise Micro 5.1 | All versions | 1.1-150200.3.14.1 |
pam_pkcs11 SUSE:Linux Enterprise Micro 5.1 | All versions | 0.6.10-150100.3.11.1 |
pam-config SUSE:Linux Enterprise Micro 5.2 | All versions | 1.1-150200.3.14.1 |
pam_pkcs11 SUSE:Linux Enterprise Micro 5.2 | All versions | 0.6.10-150100.3.11.1 |
pam-config SUSE:Linux Enterprise Micro 5.3 | All versions | 1.1-150200.3.14.1 |
pam_pkcs11 SUSE:Linux Enterprise Micro 5.3 | All versions | 0.6.10-150100.3.11.1 |
pam-config SUSE:Linux Enterprise Micro 5.4 | All versions | 1.1-150200.3.14.1 |
pam_pkcs11 SUSE:Linux Enterprise Micro 5.4 | All versions | 0.6.10-150100.3.11.1 |
pam-config SUSE:Linux Enterprise Micro 5.5 | All versions | 1.1-150200.3.14.1 |
pam_pkcs11 SUSE:Linux Enterprise Micro 5.5 | All versions | 0.6.10-150100.3.11.1 |
pam-config SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 1.1-150600.16.8.1 |
pam_pkcs11 SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 0.6.10-150600.16.8.1 |
pam-config SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.1-150600.16.8.1 |
pam_pkcs11 SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 0.6.10-150600.16.8.1 |
gdm SUSE:Linux Enterprise Module for Desktop Applications 15 SP6 | All versions | 45.0.1-150600.6.8.1 |
gdm SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | All versions | 45.0.1-150700.12.5.1 |
gdm SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 3.10.0.1-54.23.1 |
pam SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 1.1.8-24.71.1 |
pam-config SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 0.89-5.8.1 |
pam_pkcs11 SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 0.6.8-7.13.1 |
gdm SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 3.34.1-150200.8.26.1 |
pam-config SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 1.1-150200.3.14.1 |
Products include Suse Pam-Config.
How do I fix CVE-2025-6018?
Apply the vendor's patch.
Is CVE-2025-6018 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-6018 exists.
Public exploit code: 1 Exploit-DB entry and 14 proofs of concept on GitHub.
Sources
Also known as GHSA-cg9q-xmf9-7r6w, SUSE-RU-2025:20479-1, SUSE-SU-2025:02001-1, SUSE-SU-2025:02002-1, SUSE-SU-2025:02003-1, SUSE-SU-2025:02004-1 and 13 more.