CVE-2025-6018
Pam-config: lpe from unprivileged to allow_active in pam
A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unprivileged local attacker (for example, a user logged in via SSH) to obtain the elevated privileges normally reserved for a physically present, "allow_active" user. The highest risk is that the attacker can then perform all allow_active yes Polkit actions, which are typically restricted to console users, potentially gaining unauthorized control over system configurations, services, or other sensitive operations.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Pam-config: lpe from unprivileged to allow_active in pam
A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unprivileged local attacker (for example, a user logged in via SSH) to obtain the elevated privileges normally reserved for a physically present, "allow_active" user. The highest risk is that the attacker can then perform all allow_active yes Polkit actions, which are typically restricted to console users, potentially gaining unauthorized control over system configurations, services, or other sensitive operations.
- Record
CVE-2025-6018- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-04
EUVDEUVD-2025-22455
A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unprivileged local attacker (for example, a user logged in via SSH) to obtain the elevated privileges normally reserved for a physically present, "allow_active" user. The highest risk is that the attacker can then perform all allow_active yes Polkit actions, which are typically restricted to console users, potentially gaining unauthorized control over system configurations, services, or other sensitive operations.
- Record
EUVD-2025-22455- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-cg9q-xmf9-7r6w
A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux...
A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unprivileged local attacker (for example, a user logged in via SSH) to obtain the elevated privileges normally reserved for a physically present, "allow_active" user. The highest risk is that the attacker can then perform all allow_active yes Polkit actions, which are typically restricted to console users, potentially gaining unauthorized control over system configurations, services, or other sensitive operations.
- Record
GHSA-cg9q-xmf9-7r6w- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unprivileged local attacker (for example, a user logged in via SSH) to obtain the elevated privileges normally reserved for a physically present, "allow_active" user. The highest risk is that the attacker can then perform all allow_active yes Polkit actions, which are typically restricted to console users, potentially gaining unauthorized control over system configurations, services, or other sensitive operations.
- Record
CVE-2025-6018- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-04
OSVopenSUSE-SU-2025:15219-1 No score
gdm-48.0-10.1 on GA media
These are all security issues fixed in the gdm-48.0-10.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15219-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15257-1 No score
pam_pkcs11-0.6.13-2.1 on GA media
These are all security issues fixed in the pam_pkcs11-0.6.13-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15257-1- Updated
- 2026-11-02
Show 17 moreShow less
OSVSUSE-RU-2025:20479-1 No score
Recommended update for pam_pkcs11
This update for pam_pkcs11 fixes the following issues:
- Removes pam_env from auth stack for security reason [bsc#1243226]
- Record
SUSE-RU-2025:20479-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02001-1 No score
Security update for pam
This update for pam fixes the following issues:
- CVE-2025-6018: pam_env: Change the default to not read the user .pam_environment file (bsc#1243226).
- pam_namespace: convert functions that may operate on a user-controlled path to operate on file descriptors instead of absolute path (bsc#1244509).
- Record
SUSE-SU-2025:02001-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02002-1 No score
Security update for gdm
This update for gdm fixes the following issues:
- CVE-2025-6018: pam.d: removes pam_env from auth stack for security reason (bsc#1243226).
- Record
SUSE-SU-2025:02002-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02003-1 No score
Security update for gdm
This update for gdm fixes the following issues:
- CVE-2025-6018: Removes pam_env from auth stack for security reason (bsc#1243226).
- Record
SUSE-SU-2025:02003-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02004-1 No score
Security update for gdm
This update for gdm fixes the following issues:
- CVE-2025-6018: Removes pam_env from auth stack for security reason (bsc#1243226).
- Record
SUSE-SU-2025:02004-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02005-1 No score
Security update for gdm
This update for gdm fixes the following issues:
- CVE-2025-6018: Removes pam_env from auth stack for security reason (bsc#1243226).
- Record
SUSE-SU-2025:02005-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02013-1 No score
Security update for pam
This update for pam fixes the following issues:
- CVE-2025-6018: pam_env: Change the default to not read the user .pam_environment file (bsc#1243226).
- CVE-2025-6020: pam_namespace: convert functions that may operate on a user-controlled path to operate on file descriptors instead of absolute path (bsc#1244509).
- Record
SUSE-SU-2025:02013-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02015-1 No score
Security update for gdm
This update for gdm fixes the following issues:
- CVE-2025-6018: pam.d: removes pam_env from auth stack for security reason (bsc#1243226).
- Record
SUSE-SU-2025:02015-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02026-1 No score
Security update for pam_pkcs11
This update for pam_pkcs11 fixes the following issues:
- CVE-2025-6018: Removes pam_env from auth stack for security reason (bsc#1243226).
- Record
SUSE-SU-2025:02026-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02031-1 No score
Security update for pam_pkcs11
This update for pam_pkcs11 fixes the following issues:
- CVE-2025-6018: Removes pam_env from auth stack for security reason (bsc#1243226).
- Record
SUSE-SU-2025:02031-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02032-1 No score
Security update for pam_pkcs11
This update for pam_pkcs11 fixes the following issues:
- CVE-2025-6018: Removes pam_env from auth stack for security reason (bsc#1243226).
- Record
SUSE-SU-2025:02032-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02080-1 No score
Security update for pam-config
This update for pam-config fixes the following issues:
- CVE-2025-6018: Stop adding pam_env in AUTH stack, and be sure to put this module at the really end of the SESSION stack (bsc#1243226).
- Record
SUSE-SU-2025:02080-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02081-1 No score
Security update for pam-config
This update for pam-config fixes the following issues:
- CVE-2025-6018: Stop adding pam_env in AUTH stack, and be sure to put this module at the really end of the SESSION stack (bsc#1243226).
- Record
SUSE-SU-2025:02081-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02082-1 No score
Security update for pam-config
This update for pam-config fixes the following issues:
- CVE-2025-6018: Stop adding pam_env in AUTH stack, and be sure to put this module at the really end of the SESSION stack (bsc#1243226).
- Record
SUSE-SU-2025:02082-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:20496-1 No score
Security update for pam_pkcs11
This update for pam_pkcs11 fixes the following issues:
- Removes pam_env from auth stack for security reason [bsc#1243226]
- Record
SUSE-SU-2025:20496-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:20513-1 No score
Security update for pam-config
This update for pam-config fixes the following issues:
- CVE-2025-6018: Stop adding pam_env in AUTH stack, and be sure to put this module at the really end of the SESSION stack. (bsc#1243226)
- Record
SUSE-SU-2025:20513-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:20533-1 No score
Security update for pam-config
This update for pam-config fixes the following issues:
- CVE-2025-6018: Stop adding pam_env in AUTH stack, and be sure to put this module at the really end of the SESSION stack. (bsc#1243226)
- Record
SUSE-SU-2025:20533-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pam_pkcs11SUSE:Linux Micro 6.1 |
before 0.6.12-slfo.1.1_4.1 | 0.6.12-slfo.1.1_4.1 |
pamSUSE:Linux Enterprise Server 12 SP5-LTSS |
before 1.1.8-24.71.1 | 1.1.8-24.71.1 |
pamSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 1.1.8-24.71.1 | 1.1.8-24.71.1 |
gdmSUSE:Linux Enterprise Server 12 SP5-LTSS |
before 3.10.0.1-54.23.1 | 3.10.0.1-54.23.1 |
gdmSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 3.10.0.1-54.23.1 | 3.10.0.1-54.23.1 |
gdmSUSE:Linux Enterprise Module for Desktop Applications 15 SP6 |
before 45.0.1-150600.6.8.1 | 45.0.1-150600.6.8.1 |
gdmopenSUSE:Leap 15.6 |
before 45.0.1-150600.6.8.1 | 45.0.1-150600.6.8.1 |
gdmSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 41.3-150400.4.14.1 | 41.3-150400.4.14.1 |
gdmSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 41.3-150400.4.14.1 | 41.3-150400.4.14.1 |
gdmSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 41.3-150400.4.14.1 | 41.3-150400.4.14.1 |
Show 87 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gdmSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 41.3-150400.4.14.1 | 41.3-150400.4.14.1 |
gdmSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 41.3-150400.4.14.1 | 41.3-150400.4.14.1 |
gdmSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 41.3-150400.4.14.1 | 41.3-150400.4.14.1 |
gdmSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 41.3-150400.4.14.1 | 41.3-150400.4.14.1 |
gdmSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 41.3-150400.4.14.1 | 41.3-150400.4.14.1 |
gdmSUSE:Linux Enterprise Module for Desktop Applications 15 SP7 |
before 45.0.1-150700.12.5.1 | 45.0.1-150700.12.5.1 |
pamSUSE:Linux Enterprise Micro 5.3 From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise Micro 5.4 From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise Micro 5.5 From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise Module for Development Tools 15 SP6 From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Manager Proxy 4.3 From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Manager Server 4.3 From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise Micro 5.1 From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Linux Enterprise Micro 5.2 From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamSUSE:Enterprise Storage 7.1 From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
pamopenSUSE:Leap 15.6 From an advisory covering 2 CVEs |
before 1.3.0-150000.6.83.1 | 1.3.0-150000.6.83.1 |
gdmSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 3.34.1-150200.8.26.1 | 3.34.1-150200.8.26.1 |
gdmSUSE:Linux Enterprise Server 15 SP3-LTSS |
before 3.34.1-150200.8.26.1 | 3.34.1-150200.8.26.1 |
gdmSUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 3.34.1-150200.8.26.1 | 3.34.1-150200.8.26.1 |
gdmSUSE:Enterprise Storage 7.1 |
before 3.34.1-150200.8.26.1 | 3.34.1-150200.8.26.1 |
pam_pkcs11SUSE:Linux Enterprise Module for Basesystem 15 SP6 |
before 0.6.10-150600.16.8.1 | 0.6.10-150600.16.8.1 |
pam_pkcs11SUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 0.6.10-150600.16.8.1 | 0.6.10-150600.16.8.1 |
pam_pkcs11openSUSE:Leap 15.6 |
before 0.6.10-150600.16.8.1 | 0.6.10-150600.16.8.1 |
pam_pkcs11SUSE:Linux Enterprise Micro 5.3 |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Linux Enterprise Micro 5.4 |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Linux Enterprise Micro 5.5 |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Linux Enterprise Server 15 SP3-LTSS |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Linux Enterprise Server 15 SP4-LTSS |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Linux Enterprise Server 15 SP5-LTSS |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Manager Proxy 4.3 |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Manager Server 4.3 |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Linux Enterprise Micro 5.1 |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Linux Enterprise Micro 5.2 |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Enterprise Storage 7.1 |
before 0.6.10-150100.3.11.1 | 0.6.10-150100.3.11.1 |
pam_pkcs11SUSE:Linux Enterprise Server 12 SP5-LTSS |
before 0.6.8-7.13.1 | 0.6.8-7.13.1 |
pam_pkcs11SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 0.6.8-7.13.1 | 0.6.8-7.13.1 |
pam-configSUSE:Linux Enterprise Module for Basesystem 15 SP6 |
before 1.1-150600.16.8.1 | 1.1-150600.16.8.1 |
pam-configSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 1.1-150600.16.8.1 | 1.1-150600.16.8.1 |
pam-configopenSUSE:Leap 15.6 |
before 1.1-150600.16.8.1 | 1.1-150600.16.8.1 |
pam-configSUSE:Linux Enterprise Server 12 SP5-LTSS |
before 0.89-5.8.1 | 0.89-5.8.1 |
pam-configSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 0.89-5.8.1 | 0.89-5.8.1 |
pam-configSUSE:Linux Enterprise Micro 5.3 |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam-configSUSE:Linux Enterprise Micro 5.4 |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam-configSUSE:Linux Enterprise Micro 5.5 |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam-configSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam-configSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam-configSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam-configSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam-configSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam-configSUSE:Linux Enterprise Server 15 SP3-LTSS |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam-configSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam-configSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam-configSUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam-configSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam-configSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam-configSUSE:Manager Proxy 4.3 |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam-configSUSE:Manager Server 4.3 |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam-configSUSE:Linux Enterprise Micro 5.1 |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam-configSUSE:Linux Enterprise Micro 5.2 |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam-configSUSE:Enterprise Storage 7.1 |
before 1.1-150200.3.14.1 | 1.1-150200.3.14.1 |
pam_pkcs11SUSE:Linux Micro 6.0 |
before 0.6.12-5.1 | 0.6.12-5.1 |
pam-configSUSE:Linux Micro 6.0 |
before 2.11-2.1 | 2.11-2.1 |
pam-configSUSE:Linux Micro 6.1 |
before 2.11+git.20240906-slfo.1.1_2.1 | 2.11+git.20240906-slfo.1.1_2.1 |
gdmopenSUSE:Tumbleweed |
before 48.0-10.1 | 48.0-10.1 |
pam_pkcs11openSUSE:Tumbleweed |
before 0.6.13-2.1 | 0.6.13-2.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | dreysanox/CVE-2025-6018_Poc | 2025-07-03 |
| PoC in GitHub | iamgithubber/CVE-2025-6018-19-exploit | 2025-07-03 |
| Exploit-DB | Linux PAM Environment - Variable Injection Local Privilege Escalation | 2025-07-28 |
| PoC in GitHub | euxem/Analyse-faille-de-s-curit-CVE-2025-6018-CVE-2025-6019 | 2025-11-30 |
| PoC in GitHub | 0rionCollector/Exploit-Chain-CVE-2025-6018-6019 | 2026-02-09 |
| PoC in GitHub | AzureADTrent/CVE-2025-6018-and-CVE-2025-6019-Privilege-Escalation | 2026-02-09 |
| PoC in GitHub | MichaelVenturella/CVE-2025-6018-6019-PoC | 2026-02-09 |
| PoC in GitHub | muyuanlove/CVE-2025-6018-CVE-2025-6019-Privilege-Escalation-Exploit | 2026-02-09 |
| PoC in GitHub | Goultarde/CVE-2025-6018_CVE-2025-6019_autopwn | 2026-02-10 |
| PoC in GitHub | matesz44/CVE-2025-6018-19 | 2026-02-11 |
Show 5 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | DesertDemons/CVE-2025-6018-6019 | 2026-02-12 |
| PoC in GitHub | localh0ste/CVE-2025-6018-and-CVE-2025-6019 | 2026-02-13 |
| PoC in GitHub | MaxKappa/opensuse-leap-privesc-exploit | 2026-02-14 |
| PoC in GitHub | iOxsec/CVE-2025-6018-CVE-2025-6019-Privilege-Escalation-Exploit | 2026-02-22 |
| PoC in GitHub | e1arth/CVE-2025-6018 | 2026-03-02 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | EUVD, NVD | |
| exploits, facts | CVE List | |
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-6018 is a high vulnerability (CVSS 7.8) in Suse Pam-config, published June 18, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.10%, the 65th percentile. Fixed in pam_pkcs11 0.6.12-slfo.1.1_4.1.
References
access.redhat.com/security/cve/CVE-2025-6018
bugzilla.redhat.com/show_bug.cgi?id=2372693
bugzilla.suse.com/show_bug.cgi?id=1243226
cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt
openwall.com/lists/oss-security/2025/08/28/4
nvd.nist.gov/vuln/detail/CVE-2025-6018
Show 22 moreShow less
github.com/advisories/GHSA-cg9q-xmf9-7r6w
suse.com/support/update/announcement//suse-ru-202520479-1