PT-2024-1375 · Linux Pam+10 · Linux-Pam+10
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
linux-pam versions prior to 1.6.0
Description
The issue is related to the protect dir function in the pam namespace module of Linux-PAM, which is associated with incorrect resource cleanup or release. This can allow a remote attacker to cause a denial of service, resulting in a blocked login process. The problem arises because the openat call for protect dir lacks the O DIRECTORY flag, making it possible for attackers to exploit this via mkfifo.
Recommendations
For versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the pam namespace module until a patch is available. Avoid using the
protect dir function in the pam namespace module until the issue is resolved.Exploit
Fix
DoS
Improper Resource Release
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Debian
Linuxmint
Linux-Pam
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu