Amazon Linux 2023 Security Advisory: ALAS-2025-897
Advisory Release Date: 2025-03-13 04:48 Pacific
Advisory Updated Date: 2025-03-13 04:48 Pacific
Severity:
Important
Issue Overview:
The PAM module pam_cap.so of libcap configuration supports group names starting with "@", during actual parsing, configurations not starting with "@" are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames. (CVE-2025-1390)
Affected Packages:
libcap
Issue Correction:
Run dnf update libcap --releasever 2023.6.20250317 to update your system.
New Packages:
aarch64:
libcap-static-2.48-2.amzn2023.0.4.aarch64
libcap-debugsource-2.48-2.amzn2023.0.4.aarch64
libcap-2.48-2.amzn2023.0.4.aarch64
libcap-devel-2.48-2.amzn2023.0.4.aarch64
libcap-debuginfo-2.48-2.amzn2023.0.4.aarch64
src:
libcap-2.48-2.amzn2023.0.4.src
x86_64:
libcap-static-2.48-2.amzn2023.0.4.x86_64
libcap-2.48-2.amzn2023.0.4.x86_64
libcap-debuginfo-2.48-2.amzn2023.0.4.x86_64
libcap-debugsource-2.48-2.amzn2023.0.4.x86_64
libcap-devel-2.48-2.amzn2023.0.4.x86_64