Linux-PAM vulnerabilities

The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module does not correctly restrict login when a user tries to connect from an IP address that is not resolvable via DNS — in such conditions, a user with denied access to a machine can still get access.

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path, allowing a local or network-adjacent attacker to recover the plaintext password of a target account by measuring response-timing differences.

A vulnerability was found in the pam_namespace module of linux-pam, where user-controlled paths are not properly protected. A local attacker can exploit symlink attacks and race conditions to escalate privileges to root.

A vulnerability in Linux PAM before version 1.6.0 allows attackers to cause a denial of service by blocking the login process. The issue stems from the lack of the O_DIRECTORY flag in the openat call for the protect_dir function, enabling the use of mkfifo.