Date: 2025-09-03 Updated: 2025-10-08
HIGH risk vulnerabilities concerning pam_namespace which may allow privilege escalation.
EGI SVG ID : EGI-SVG-2025-15
CVE ID : CVE-2025-6020, CVE-2025-8941
CVSS Score : 7.8 [R 1], [R 2]
Sites using pam_namespace are recommended to urgently apply vendor updates using the references below as soon as patches are available for the distrubution they run.
Sites should be aware that if a public exploit is released which allows easy root access in the EGI infrastructure, these vulnerabilities are likely to be elevated to ‘CRITICAL’ risk and sites will then be required to patch or have mitigation in place within 7 days or risk suspension.
Note that CVE-2025-8941 is due to a potentially RedHat-specific, incomplete fix for CVE-2025-6020.
TLP:CLEAR information - Unlimited distribution
https://advisories.egi.eu/Advisory-EGI-SVG-2025-15
https://advisories.egi.eu/Advisory-SVG-CVE-2025-6020
https://advisories.egi.eu/Advisory-SVG-CVE-2025-8941
Minor updates may be made without re-distribution to the sites.
This advisory is subject to the Creative Commons licence
https://creativecommons.org/licenses/by/4.0/ and
the EGI (https://www.egi.eu/) Software Vulnerability Group
must be credited. -----------------------------
Comments or questions should be sent to svg-rat at mailman.egi.eu
Vulnerabilities relevant for EGI can be reported at report-vulnerability at egi.eu
(see [R 99] for further details, and other information on SVG)
[R 7] https://security-tracker.debian.org/tracker/CVE-2025-6020
[R 8] https://security-tracker.debian.org/tracker/CVE-2025-8941
[R 11] https://errata.build.resf.org/ (RockyLinux)
[R 12] https://errata.almalinux.org/ (AlmaLinux)
[R 99] https://confluence.egi.eu/display/EGIBG/SVG+Advisories
SVG was alerted to this vulnerability by Mischa Salle.