Executive brief
pam_authnft is a security module used to manage firewall rules for user sessions on Linux systems. A vulnerability in how the module processes network diagnostic data allows a specially crafted message to cause a system crash or service disruption. This could be exploited by a malicious process on the same system to interfere with authentication services or cause a denial-of-service condition.
Technical details
A heap buffer over-read exists in the peer_lookup_tcp function within src/peer_lookup.c due to improper handling of Netlink message alignment. The vulnerability stems from a logic error where the code uses NLMSG_OK for size validation but advances the pointer using NLMSG_NEXT, which applies 4-byte alignment. An attacker can craft a NETLINK_SOCK_DIAG reply where the aligned length exceeds the remaining buffer size, causing an integer underflow of the length counter and a subsequent out-of-bounds read. This is reachable during the pam_sm_open_session path when rhost_policy is set to 'kernel'. The issue is fixed in version 0.2.0-alpha by implementing a manual walker that validates alignment before advancing.
Affected products
- identd-ng pam_authnft <= 0.1.0-alpha
Timeline
- 2026-04-25: patched: Fix merged in pull request #10
- 2026-04-25: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD