CVE-2025-1390

Name	CVE-2025-1390
Description	The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1098318

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libcap2 (PTS)	bullseye	1:2.44-1	vulnerable
	bookworm	1:2.66-4	vulnerable
	trixie	1:2.66-5	vulnerable
	sid	1:2.73-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libcap2	source	(unstable)	1:2.73-4			1098318

Notes

[bookworm] - libcap2 <no-dsa> (Minor issue)
https://bugzilla.openanolis.cn/show_bug.cgi?id=18804
Fixed by: https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=1ad42b66c3567481cc5fa22fc1ba1556a316d878 (cap/v1.2.74-rc4)