Junglewise Threat Intelligence

CVE-2024-22365: Linux-PAM denial of service in pam_namespace

CVE-2024-22365 · Severity: medium · CVSS 5.5 · Published 2024-02-06

Executive brief

A vulnerability in the Linux Pluggable Authentication Modules (PAM) can allow a local user to block the login process for others. By creating a special type of file in a specific directory, an attacker can cause the system's authentication service to hang indefinitely. This results in a denial of service where users are unable to log into the affected system.

Technical details

A local denial of service vulnerability exists in the pam_namespace.so module of Linux-PAM. The protect_dir() function, which implements an algorithm to protect target paths for bind mounts, fails to use the O_DIRECTORY flag during openat() calls. An unprivileged local attacker can exploit this by creating a FIFO (named pipe) at a path component controlled by them. When a subsequent login attempt triggers the PAM module to crawl this path, the openat() call will block indefinitely on the FIFO, hanging the login process. The issue is resolved in version 1.6.0 by ensuring O_DIRECTORY is passed to openat(), causing the call to fail immediately if the path is not a directory.

Affected products

  • Linux-PAM project Linux-PAM before 1.6.0

Timeline

  • 2023-12-27: disclosed: Initial report to upstream maintainers
  • 2024-01-17: patched: Upstream version 1.6.0 released with fix
  • 2024-01-18: advisory: Public disclosure on oss-security mailing list
  • 2024-02-06: advisory: CVE published in NVD

References