CVE-2025-1390

MediumCVSS 6.1

Published: 18/02/2025(UTC)Updated: 15/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The PAM module pam_cap.so of libcap configuration supports group names starting with "@", but during actual parsing, configurations not starting with "@" are incorrectly recognized as group names. This may result in unintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.

Risk Assessment

A local attacker may gain inherited capabilities intended for other users, leading to privilege escalation. The risk affects systems using /etc/security/capability.conf for privilege configuration.

Recommendation

Update libcap to a version containing the fix for CVE-2025-1390. Review /etc/security/capability.conf for entries that may be misinterpreted as group names.

Other vulnerabilities in libcap

CVE-2026-4878Medium
A flaw was found in libcap. A local unprivileged user can exploit a TOCTOU race condition in the `cap_set_file()` function, allowing an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file.

Original NVD description (English source)

The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS