CVE-2025-6018
HighPublished
Pam-config: lpe from unprivileged to allow_active in pam
- Published
- Jul 23, 2025
- Updated
- Jun 30, 2026
- Assigning CNA
- redhat
- Evidence observed
- Jul 28, 2025
Primary CVSS
7.8/ 10High
Pam-config: lpe from unprivileged to allow_active in pam
nvd · CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLow · next 30 days
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unprivileged local attacker (for example, a user logged in via SSH) to obtain the elevated privileges normally reserved for a physically present, "allow_active" user. The highest risk is that the attacker can then perform all allow_active yes Polkit actions, which are typically restricted to console users, potentially gaining unauthorized control over system configurations, services, or other sensitive operations.
Exploit Chain of CVE-2025-6018 to CVE-2025-6019
CVE-2025-6018 CVE-2025-6019 PoC Exploit - Local Privilege Escalation in openSUSE/SUSE Linux Enterprise 15 - PAM bypass + udisks2 XFS race condition LPE to root
Auto exploit for CVE-2025-6018 & CVE-2025-6019 based on https://github.com/0rionCollector/Exploit-Chain-CVE-2025-6018-6019
Exploit chain for local privilege escalation on SUSE Linux, chaining PAM environment injection and a udisks2 race condition to obtain a root shell.
Privilege escalation exploit chain (CVE-2025-6018 + CVE-2025-6019) for openSUSE Leap 15.6
A Proof of Concept for chaining CVE-2025-6018 (PAM/Polkit Active Session Bypass) and CVE-2025-6019 (libblockdev SUID Mount Flaw) to achieve Local Privilege Escalation (LPE) on vulnerable Linux systems.
HackTheBox — Pterodactyl (Medium/Linux) walkthrough. CVE-2025-49132 LFI → pearcmd RCE → bcrypt crack → SSH. Privesc via CVE-2025-6018 (PAM pam_environment bypass) + CVE-2025-6019 (udisks2 XFS resize race condition, nosuid bypass) → root. Full notes and steps included.
This is just a quick note on how to exploit these vulnerabilities to get root.
Exploit for CVE-2025-6019
Exploit guide for CVE-2025-6018/6019 privilege escalation via XFS image manipulation and PAM environment variable abuse to gain root access on Linux systems.
Hands-on lab demonstrating exploitation of CVE-2025-6018 and CVE-2025-6019 using a pre-configured openSUSE Leap VM with Vagrant and VirtualBox for security education.
Exploit for CVE-2025-6018-19 targeting a specific vulnerability. Shell-based proof-of-concept for security testing and vulnerability validation.
Step-by-step privilege escalation exploit for CVE-2025-6018 and CVE-2025-6019 using XFS image manipulation and PAM environment variable injection to gain root access on Linux systems.
Exploit chain for privilege escalation via PAM environment poisoning (CVE-2025-6018) and XFS filesystem resize (CVE-2025-6019) to gain root shell on Linux systems.
CVE-2025-6018 (pam LPE unpriv->allow_active), CVE-2025-6019 (udisks LPE allow_active->root) in sh
CVE-2025-6018 + CVE-2025-6019 Privilege Escalation Exploit
Script-only privilege escalation chain using CVE-2025-6019 and UDisks2 (no filesystem image included).
İbrahimsql · linux · Jul 28, 2025
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.