发布时间: 2025年4月20日
修改时间: 2025年4月20日
pam_oath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context of PAM code running as root, it mishandles usersfile access, such as by calling fchown in the presence of a symlink.
| NVD | openEuler | |
|---|---|---|
| Confidentiality | High | |
| Attack Vector | Local | |
| CVSS评分 | N/A | 7.1 |
| Attack Complexity | Low | |
| Privileges Required | Low | |
| Scope | Unchanged | |
| Integrity | High | |
| User Interaction | None | |
| Availability | None |
| 公告名 | 概要 | 发布时间 |
|---|---|---|
| KylinSec-SA-2025-2436 | pam_oath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context of PAM code running as root, it mishandles usersfile access, such as by calling fchown in the presence of a symlink. | 2025年5月30日 |
| 产品 | 包 | 状态 |
|---|---|---|
| KY3.4-5A | oath-toolkit | Unaffected |
| KY3.5.3 | oath-toolkit | Unaffected |
| V6 | oath-toolkit | Unaffected |
