Description
The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls, which might allow local users to obtain sensitive information by leveraging unintended group permissions, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pam | 1.1.3-1 | — |
| Debian 13 | pam | 1.1.3-1 | — |
| Debian 12 | pam | 1.1.3-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pam | 1.3.0-3.4 | openSUSE-SU-2024:10405-1 |
Advisories 1
- openSUSE-SU-2024:10405-1 pam-1.3.0-3.4 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- [oss-security] 20100927 Re: Minor security flaw with pam_xauth mailing-list
- [oss-security] 20100921 Re: Minor security flaw with pam_xauth mailing-list
- GLSA-201206-31 vendor-advisory
- [oss-security] 20101004 Re: Minor security flaw with pam_xauth mailing-list
- [oss-security] 20100924 Re: Minor security flaw with pam_xauth mailing-list
- [oss-security] 20100921 Re: Minor security flaw with pam_xauth mailing-list
- [oss-security] 20100921 Re: Minor security flaw with pam_xauth mailing-list
- [oss-security] 20100928 Re: Minor security flaw with pam_xauth mailing-list
- http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=843807a3a90f52e7538be756616510730a24739a
- [oss-security] 20100927 Re: Minor security flaw with pam_xauth mailing-list
- [oss-security] 20100921 Re: Minor security flaw with pam_xauth mailing-list
- 49711 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=641361
- [oss-security] 20100928 Re: Minor security flaw with pam_xauth mailing-list
- [oss-security] 20101025 Re: Minor security flaw with pam_xauth mailing-list
- [oss-security] 20100921 Re: Minor security flaw with pam_xauth mailing-list