A critical local privilege escalation flaw in the Linux PAM configuration utility allows low-privileged users to bypass authorization controls and gain elevated system privileges.

This vulnerability is an incorrect authorization flaw (CWE-863) within the pam-config component. It permits an authenticated, low-privileged local user to escalate privileges by executing Polkit actions that are intended only for physically present or console-authenticated users.

The ability for a standard user to escalate privileges to a level typically reserved for administrative or console-based users poses a severe threat to system integrity and confidentiality. With a CVSS score of 7.8, this vulnerability allows attackers to modify system configurations, manage services, and access sensitive data, potentially leading to a full system compromise. This risk is particularly acute in multi-user environments, including servers and cloud instances where untrusted users may hold local accounts.

Immediate Action: Administrators must update the PAM packages to version 1.1.8-24.71.1 or the version specified by their respective Linux distribution vendor.

Proactive Monitoring: Review system logs for unusual Polkit activity or unauthorized attempts to execute administrative tasks by standard user accounts.

Compensating Controls: Restrict local shell access to untrusted users and enforce strict Polkit policy configurations to limit the scope of actions available to non-administrative users.

Public Exploit Available: Yes, a public exploit is available via ExploitDB and multiple GitHub repositories.

Given the availability of public exploits and the high potential for total system compromise, this vulnerability requires immediate attention. Security teams should prioritize patching all affected Linux distributions to prevent local attackers from elevating their privileges. Organizations that cannot immediately update should audit their Polkit configurations to minimize the exposure of sensitive actions to unauthorized users.