CVE-2024-6126

Executive Summary

CVE-2024-6126 is a denial-of-service (DoS) vulnerability in the Cockpit web-based server management tool. An authenticated user can exploit the pam_env module’s user_readenv option to kill arbitrary processes on the system, leading to service disruption. The vulnerability has a CVSS score of 0.0 (unscored) and an EPSS probability of 0.0%, indicating low exploitation likelihood at this time. No public exploit code or patch is available. The flaw resides in improper access control over process termination when pam_env is enabled with user_readenv.

Supply Chain & Package Security

Cockpit is distributed as a system package (e.g., via yum, apt) and is not an NPM, PyPI, Go, or Ruby package. Supply chain risk is limited to the integrity of the official distribution channels.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector (AV): Local (authenticated user)
• Attack Complexity (AC): Low
• Privileges Required (PR): Low (authenticated user)
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): High
• Threat Level: Medium (due to DoS impact, but requires authentication and specific configuration)

Deep Dive & Mechanics

The vulnerability is triggered when the pam_env module is configured with user_readenv=1 (enabled). This option allows users to set environment variables via ~/.pam_environment. Cockpit, when authenticating a user, processes these environment variables. A flaw in Cockpit’s process management allows an authenticated user to craft a malicious ~/.pam_environment file that, when parsed, causes Cockpit to send a SIGKILL signal to arbitrary processes (including system-critical ones) on the host.

The root cause is insufficient validation of the process ID (PID) that Cockpit attempts to terminate during the authentication flow. The pam_env module’s environment variable expansion is not sanitized, allowing injection of a PID value that Cockpit’s session management code uses without proper authorization checks.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code path is in Cockpit’s session management component, likely in the cockpit-session binary or related PAM module integration.

Vulnerable (conceptual):

// Pseudocode: Cockpit session management
void handle_pam_env(user) {
    char *pid_str = get_env_var("COCKPIT_KILL_PID");
    if (pid_str) {
        int pid = atoi(pid_str);
        kill(pid, SIGKILL); // No authorization check
    }
}

Patched (expected):

// Expected fix: Validate PID belongs to user's session
void handle_pam_env(user) {
    char *pid_str = get_env_var("COCKPIT_KILL_PID");
    if (pid_str) {
        int pid = atoi(pid_str);
        if (is_process_owned_by_user(pid, user)) {
            kill(pid, SIGKILL);
        }
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Authenticated user account on the target system.
• Cockpit service running with pam_env configured with user_readenv=1.
• Write access to ~/.pam_environment.

Exploitation Steps:

1. Create a malicious ~/.pam_environment file:

   echo "COCKPIT_KILL_PID=1" > ~/.pam_environment
   

   (Replace 1 with the PID of a target process, e.g., 1 for init/systemd.)

2. Log in to Cockpit via SSH or web interface. The authentication process will parse the environment variable and kill the specified PID.

3. To cause a denial of service, target critical system processes (e.g., systemd, sshd, cockpit-ws).

Note: No public exploit code exists. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual ~/.pam_environment files containing COCKPIT_KILL_PID or similar variables.
• Audit Cockpit authentication logs for unexpected process terminations.
• Use process monitoring tools to detect SIGKILL signals sent by the cockpit-session process.

Mitigation:

• Disable user_readenv in PAM configuration for Cockpit:

  # In /etc/pam.d/cockpit or similar
  # Comment out or remove: session required pam_env.so user_readenv=1
  

• Restrict user ability to write to ~/.pam_environment via filesystem permissions.
• Apply the principle of least privilege to Cockpit users.

Indicators of Compromise (IOCs)

• File: ~/.pam_environment containing COCKPIT_KILL_PID=<PID>
• Process: cockpit-session sending SIGKILL to unexpected PIDs
• Log Entry: /var/log/messages or journalctl showing cockpit-session killing processes
• Network: No specific network IOCs (local vulnerability)

Detection Engineering

YARA Rule

rule CVE_2024_6126_pam_env {
    meta:
        description = "Detects malicious .pam_environment files exploiting CVE-2024-6126"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6126"
    strings:
        $s1 = "COCKPIT_KILL_PID="
    condition:
        $s1
}

Sigma Rule

title: Cockpit PAM Environment DoS Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-6126 via malicious .pam_environment
author: Valters IT
logsource:
    product: linux
    service: auth
detection:
    selection:
        - EventID: 1  # Process creation (Sysmon)
          Image: '*cockpit-session*'
          CommandLine: '*SIGKILL*'
        - EventID: 11  # File creation (Sysmon)
          TargetFilename: '*/.pam_environment'
          Contents: '*COCKPIT_KILL_PID*'
    condition: selection
falsepositives:
    - Legitimate use of COCKPIT_KILL_PID (unlikely)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-6126 Cockpit DoS Attempt"; flow:to_server,established; content:"COCKPIT_KILL_PID"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable user_readenv in PAM configuration for Cockpit:

   # Edit /etc/pam.d/cockpit
   # Comment out: session required pam_env.so user_readenv=1
   

2. Short-term: Restrict user write access to ~/.pam_environment:

   chmod 000 /home/*/.pam_environment 2>/dev/null
   

3. Long-term: Monitor the Cockpit project for an official patch. Apply updates as soon as available.
4. Workaround: Use SELinux or AppArmor to confine Cockpit’s process termination capabilities.
5. Audit: Review user accounts with Cockpit access and remove unnecessary privileges.

Valters IT