CVE-2025-1390: CWE-284: Improper Access Control in OpenAnolis Anolis OS
Description
CVE-2025-1390 is an improper access control vulnerability in the pam_cap.so module of libcap on OpenAnolis Anolis OS. The vulnerability arises because group names not starting with '@' are incorrectly recognized as group names during configuration parsing. This can cause unintended users to inherit capability sets, potentially allowing local privilege escalation. The issue affects systems using /etc/security/capability.conf for user privilege configuration.
CVSS v3.1
Score 6.1medium
Affected software
OpenAnolis
Anolis OS
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The PAM module pam_cap.so in libcap of OpenAnolis Anolis OS improperly parses group names in its configuration, treating names not starting with '@' as group names. This parsing flaw can lead to nonintended users being granted inherited capabilities. Attackers can exploit this by crafting specific usernames to escalate privileges locally on affected systems that use /etc/security/capability.conf to configure user inherited privileges.
Potential Impact
The vulnerability allows local attackers to gain elevated privileges by exploiting incorrect parsing of group names in the PAM module configuration. This can lead to unauthorized privilege escalation, impacting system integrity and security. The CVSS score of 6.1 indicates a medium severity with low attack complexity and no user interaction required.
Mitigation Recommendations
No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should review and carefully validate /etc/security/capability.conf configurations to avoid unintended group name parsing issues.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Anolis
- Date Reserved
- 2025-02-17T06:36:53.706Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad02dbd2cdf04f656f2a271
Added to database: 10/15/2026, 01:34:53 UTC
Last enriched: 10/15/2026, 01:48:25 UTC
Last updated: 10/15/2026, 01:49:44 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.