CVE-2025-6020: 
Linux Debian vulnerability analysis and mitigation

A critical vulnerability (CVE-2025-6020) was discovered in the pamnamespace.so PAM module, which is part of the linux-pam project. The vulnerability was discovered on January 29, 2025, and was fixed in linux-pam version 1.7.1 released on June 17, 2025. The flaw affects the module's handling of polyinstantiated directories, where it may access user-controlled paths without proper protection (Openwall OSS, [Red Hat Bugzilla](https://bugzilla.redhat.com/showbug.cgi?id=2372512)).

The vulnerability stems from the pamnamespace module's approach to handling directories owned by or writable by unprivileged users. While the module employs two security techniques - using file descriptors with relative paths and bind mounting directories - the second technique is only effective if the malicious user operates in the same mount namespace as the mount operation. This limitation, introduced in Linux 3.18, allows users to alter paths on which pamnamespace operates as root if they can launch a process outside of their PAM session's mount namespace. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability allows local users to elevate their privileges to root through multiple symlink attacks and race conditions. This is particularly impactful in scenarios where two users are colluding on the same system or when PAM services are misconfigured to not call pam_namespace when creating new PAM sessions. The successful exploitation of this vulnerability could lead to complete system compromise with root privileges (Openwall OSS).

The vulnerability has been fixed in linux-pam version 1.7.1 through several changes: converting all functions that operate on user-controlled paths to use file descriptors instead of absolute paths, maintaining the bind-mount protection as a defense-in-depth measure, and adding new flags to the namespace.init script to indicate path safety. Users are advised to upgrade to linux-pam v1.7.1 or later. Additionally, system administrators who use custom namespace.init scripts should update them to check for the new safety flags and avoid operating on user-controlled paths (Openwall OSS).