Input validation error in libcap - CVE-2025-1390

Vulnerability identifier: #VU104166

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-1390

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input when parsing groups names. The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. A local user can use this vulnerability to escalate privileges on systems where "/etc/security/capability.conf" is used to configure user inherited privileges by constructing specific usernames.

libcap
Anolis OS
openEuler
Ubuntu
IBM Automation Decision Services
libpam-cap (Ubuntu package)
libcap
libcap-devel
libcap-static
libcap-debuginfo
libcap-debugsource
libcap-help

Install updates from vendor's website.

IBM Automation Decision Services - update to 24.0.0.0.4
libpam-cap (Ubuntu package) - addressed in versions 1:2.32-1ubuntu0.2, 1:2.44-1ubuntu0.22.04.2, 1:2.66-5ubuntu2.2, 1:2.66-5ubuntu3.1
libcap - addressed in versions 2.48-6.0.2, 2.69-3
libcap-devel - addressed in versions 2.48-6.0.2, 2.69-3
libcap-static - update to 2.69-3
libcap - update to 2.69-4
libcap-debuginfo - update to 2.69-4
libcap-debugsource - update to 2.69-4
libcap-devel - update to 2.69-4
libcap-help - update to 2.69-4

• https://bugzilla.openanolis.cn/show_bug.cgi?id=18804
• https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=1ad42b66c3567481cc5fa22fc1ba1556a316d878
• https://gitee.com/src-anolis-os/libcap/pulls/12

• Improper input validation in libcap
• Ubuntu update for libcap2
• openEuler update for libcap
• Anolis OS update for libcap
• Multiple vulnerabilities in IBM Automation Decision Services
• Multiple vulnerabilities in IBM Automation Decision Services
• Anolis OS update for libcap