pam_usb vulnerabilities

In versions prior to 0.9.2, pam_usb has a symlink race condition in per-device and per-user pad directory creation. A local attacker can exploit this vulnerability by replacing the target path with a symlink to a directory they control.

In versions prior to 0.9.2, pam_usb creates a temporary file without the O_EXCL flag when updating a one-time pad file. This can lead to a situation where two concurrent processes updating the same pad may both succeed, resulting in overwriting the pad value.

In versions prior to 0.9.2, pam_usb calls xmlReadFile() with flags=0 when loading the configuration file, allowing libxml2 to process external entity references (XXE). This can lead to outbound network connections or local file reads at XML parse time from the context of the authenticating process.

In versions prior to 0.9.2, the pam_usb module, responsible for hardware authentication on Linux, is vulnerable to environment variable injection. The XRDP_SESSION, DISPLAY, and TMUX variables can be manipulated by a local user, affecting the local and remote session checking logic.

In pam_usb versions 0.9.1 and earlier, a bug can lead to an infinite loop DoS due to improper initialization of the *ppid variable. In the pusb_local_login() function, the same variable is reused as input and output in a loop, which can cause the authenticating process to hang.

In versions 0.9.1 and below, the pam_usb module can cause a NULL dereference crash when parsing loginctl output. The pusb_is_loginctl_local() function calls popen() and reads the result, which can lead to undefined behavior and crashing the PAM module.

In versions 0.9.1 and below, the xfree() function in pam_usb releases memory without first zeroing the buffer contents, leading to the exposure of sensitive data in freed memory. This could allow recovery of pad values or other authentication material from freed memory regions.

In pam_usb prior to 0.9.0, three functions used by the deny_remote feature called the non-reentrant strtok(), which stores state in a single global pointer. If two authentications race, one thread's strtok() call can overwrite the other's in-progress tokenisation pointer, causing incorrect parsing of tmux session data or the /proc environ scan. Additionally, pusb_tmux_get_client_tty() passed the raw pointer returned by getenv(TMUX) directly to strtok(), permanently corrupting the TMUX variable in the process. This vulnerability is fixed in 0.9.0.

In pam_usb before 0.9.0, the deny_remote feature checks utmpx ut_addr_v6 but only tests the first 32-bit word of the 128-bit address. IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) have a zero first word, so IPv4 SSH sessions are incorrectly treated as local. This allows bypassing the deny_remote restriction and authenticating over SSH with a registered USB device.

In versions prior to 0.8.7, pam_usb reads the user's $TMUX environment variable and interpolates its value without proper sanitization, allowing arbitrary shell syntax injection. This creates a risk of unauthorized command execution as root.

pam_usb prior to version 0.8.7 allows remote code execution (RCE) as root through a crafted UUID in the configuration. Running pamusb-conf --reset-pads with such a UUID leads to exploitation of the vulnerability.

pam_usb prior to version 0.8.7 is vulnerable to symlink attacks that allow authentication bypass and root file corruption. Version 0.8.7 includes a fix for this vulnerability.

In pam_usb prior to 0.8.7, src/device.c passed the return values of udisks_drive_get_serial(), udisks_drive_get_vendor(), and udisks_drive_get_model() directly to strcmp() without NULL checks. The GIO/UDisks API can return NULL for devices that do not expose the corresponding field, and passing NULL to strcmp() is undefined behaviour (typically a SIGSEGV). This vulnerability is fixed in 0.8.7.

In pam_usb prior to 0.9.1, src/evdev.c silently ignores EACCES errors when opening /dev/input/event* nodes, causing pusb_has_virtual_input_device() to return 0 (no virtual devices found) even when every open() call failed due to insufficient permissions. The caller in src/local.c cannot distinguish a clean absence of virtual devices from a permission-denied scan and acts on the false negative by continuing authentication without denying. This vulnerability is fixed in 0.9.1.

In pam_usb, src/log.c contains a process-wide static pointer written on every PAM invocation with the address of a stack-local variable. This violates the PAM re-entrancy requirement and creates a data race when the PAM stack is invoked concurrently from multiple threads. The vulnerability is fixed in 0.9.1.

In pam_usb prior to 0.9.1, src/conf.c allocates heap memory proportional to n_devices, a count derived from libxml2 XPath evaluation of the config file, without first enforcing an upper bound. On 32-bit targets the multiplication n_devices * sizeof(t_pusb_device) wraps around size_t, causing xmalloc() to receive a very small size, and subsequent array writes overflow the heap. This vulnerability is fixed in 0.9.1.

In pam_usb prior to 0.9.0, multiple helper tools resolved external binaries through the PATH environment variable rather than using absolute paths. An attacker who can influence the process environment during PAM authentication or tool execution could substitute malicious binaries. The affected tools are pamusb-check (src/tmux.c), pamusb-conf (tools/pamusb-conf), and pamusb-keyring-unlock-gnome (tools/pamusb-keyring-unlock-gnome). This vulnerability is fixed in 0.9.0.

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb builds XPath expressions from user-supplied identifiers (PAM username, service name) and device-supplied identifiers (USB serial, model, vendor) to query /etc/pamusb.conf. These identifiers were not validated for XPath metacharacters, allowing injection of arbitrary XPath predicates.

In versions prior to 0.9.0, the pusb_pad_compare() function in pam_usb did not enforce the presence and readability of the pad file on the USB device, allowing users to authenticate without the physical device. A user could delete their ~/.pamusb/device.pad, resulting in successful authentication without the required USB device.

In pam_usb before 0.9.0, out-of-memory guards in xmalloc(), xrealloc(), and xstrdup() relied on assert(data != NULL), which is compiled out when NDEBUG is defined (common in release builds). The functions then silently return NULL, and every caller dereferences the result without a NULL check, crashing the PAM module. A crash in a PAM module used by sudo or login causes a local denial-of-service condition. The vulnerability is fixed in 0.9.0.