Amazon Linux 2023 Security Advisory: ALAS2023-2025-1257
Advisory Released Date: 2025-11-10
Advisory Updated Date: 2025-11-10
Severity:
Medium
Issue Overview:
A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020. (CVE-2025-8941)
Affected Packages:
pam
Issue Correction:
Run dnf update pam --releasever 2023.9.20251110 or dnf update --advisory ALAS2023-2025-1257 --releasever 2023.9.20251110 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
aarch64:
pam-devel-1.5.1-8.amzn2023.0.7.aarch64
pam-docs-1.5.1-8.amzn2023.0.7.aarch64
pam-debugsource-1.5.1-8.amzn2023.0.7.aarch64
pam-debuginfo-1.5.1-8.amzn2023.0.7.aarch64
pam-1.5.1-8.amzn2023.0.7.aarch64
src:
pam-1.5.1-8.amzn2023.0.7.src
x86_64:
pam-debugsource-1.5.1-8.amzn2023.0.7.x86_64
pam-docs-1.5.1-8.amzn2023.0.7.x86_64
pam-devel-1.5.1-8.amzn2023.0.7.x86_64
pam-1.5.1-8.amzn2023.0.7.x86_64
pam-debuginfo-1.5.1-8.amzn2023.0.7.x86_64