Description

The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-20T15:17:38.913Z",
  "pubdate": "2026-08-20T15:17:38.913Z",
  "executiveSummary": "An arbitrary shell command injection vulnerability exists in the Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice prior to version 23.13.9-8ubuntu7. The vulnerability stems from the improper handling of user-controlled environment configuration data within a GNU sed replacement expression.\nAn authenticated local attacker can exploit this flaw by manipulating the LANGUAGE entry within their user-controlled ~/.pam_environment file and invoking the SetLanguage D-Bus method. Successful exploitation results in the execution of arbitrary shell commands with the elevated privileges of the AccountsService helper process, which operates with a real UID of 0.\nThis vulnerability poses a significant risk to system integrity and confidentiality, allowing local privilege escalation on affected Ubuntu systems. The attack vector requires local access to modify user environment files and interact with the system D-Bus interface, but requires no prior administrative privileges for the initiating user account.",
  "technicalDetails": "The root cause of the vulnerability lies in insecure input validation and string interpolation within the Ubuntu-specific language helper scripts, specifically save-to-pam-env and update-langlist, which are components of the accountsservice package prior to version 23.13.9-8ubuntu7.\nDuring the processing of user localization settings via the SetLanguage D-Bus method, the helper scripts read the LANGUAGE entry from the user-controlled ~/.pam_environment file. The application treats this input as trusted data and interpolates the unescaped string directly into a GNU sed replacement expression.\nBecause the input is not properly sanitized or bounded, an attacker can craft a malicious LANGUAGE payload containing specific sed command delimiters and the 'e' flag extension supported by GNU sed. The 'e' flag instructs sed to execute the resulting replacement string as a shell command using the system shell.\nThe step-by-step attack flow proceeds as follows: First, the attacker modifies or creates the ~/.pam_environment file within their home directory, injecting a specially crafted payload into the LANGUAGE variable. Second, the attacker triggers the vulnerability by calling the SetLanguage D-Bus method provided by AccountsService, passing parameters that force the helper scripts to parse the malicious ~/.pam_environment file.\nThird, the vulnerable helper scripts (save-to-pam-env or update-langlist) execute the flawed GNU sed command containing the interpolated user input. Fourth, GNU sed processes the replacement expression, encounters the injected 'e' flag, and evaluates the payload string in a shell context.\nFinally, the arbitrary shell commands embedded in the payload execute with the privileges of the AccountsService helper process. Because the helper process executes with a real UID of 0, the attacker achieves arbitrary code execution with root privileges, leading to complete compromise of the local operating system."
}