Amazon Linux 2 Security Advisory: ALAS-2025-2796
Advisory Release Date: 2025-03-13 01:30 Pacific
Advisory Updated Date: 2025-03-25 16:12 Pacific
The PAM module pam_cap.so of libcap configuration supports group names starting with "@", during actual parsing, configurations not starting with "@" are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames. (CVE-2025-1390)
Affected Packages:
libcap
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update libcap to update your system.
aarch64:
libcap-2.54-1.amzn2.0.3.aarch64
libcap-static-2.54-1.amzn2.0.3.aarch64
libcap-devel-2.54-1.amzn2.0.3.aarch64
libcap-debuginfo-2.54-1.amzn2.0.3.aarch64
i686:
libcap-2.54-1.amzn2.0.3.i686
libcap-static-2.54-1.amzn2.0.3.i686
libcap-devel-2.54-1.amzn2.0.3.i686
libcap-debuginfo-2.54-1.amzn2.0.3.i686
src:
libcap-2.54-1.amzn2.0.3.src
x86_64:
libcap-2.54-1.amzn2.0.3.x86_64
libcap-static-2.54-1.amzn2.0.3.x86_64
libcap-devel-2.54-1.amzn2.0.3.x86_64
libcap-debuginfo-2.54-1.amzn2.0.3.x86_64