Re: CVE-2025-6019: LPE from allow_active to root in libblockdev via udisks

[Simon McVittie <smcv () debian org>]

On Tue, 17 Jun 2025 at 20:00:59 +0000, Qualys Security Advisory wrote:
> On Debian 12 and Ubuntu 24.04, when an unprivileged user logs in via
> sshd, PAM's pam_env module (from Linux-PAM 1.5.x) also reads this user's
> ~/.pam_environment file, because pam_env's "user_readenv" is explicitly
> set to 1 in /etc/pam.d/sshd (it is 0 by default, since Linux-PAM 1.4.0).

The upcoming Debian 13 release no longer does this by default 
(https://bugs.debian.org/1018260) and presumably neither do newer Ubuntu 
releases.

I think the underlying problem here is that PAM has historically made it 
ambiguous whether environment variables are trusted (trustable) or not.  
The result is that some components (like pam_systemd's use of 
XDG_SESSION_ID) behave as though the PAM environment is a trusted 
channel through which the system can communicate information about a 
session - indeed, there might not be any other way to get that 
information - while other components (like pam_env with user_readenv) 
behave as though the PAM environment is a piece of per-user 
configuration that can be arbitrarily configured by the user for maximum 
flexibility, but therefore can't be trusted by higher-privileged 
components. It could reasonably be either of those, but it can't be 
both.

The conflation of the "PAM environment" (ambiguously trusted) with
the environ(7) that will be inherited by the final program (untrusted 
user configuration where maximum flexibility is an expected feature) 
doesn't help this.

    smcv