Executive brief
pam_usb is a Linux authentication module that allows users to log in using a physical USB drive instead of a password. A security flaw allows a local attacker to bypass this hardware check by using symbolic links to point the system at fake authentication data. Additionally, the flaw can be used to corrupt critical system files, potentially leading to a complete system failure or permanent data loss.
Technical details
Multiple vulnerabilities exist in src/pad.c of pam_usb due to insecure file handling. First, the module uses stat() on the pad directory, allowing a user to replace it with a symlink to an attacker-controlled directory to bypass hardware authentication. Second, the module uses fopen() on temporary pad files without O_NOFOLLOW, allowing a local user to create a symlink that causes the PAM module (running as root) to truncate and corrupt arbitrary system files during authentication. Finally, a partial read vulnerability in the pad comparison function can lead to uninitialized memory being used in authentication checks. These issues are resolved in version 0.8.7 by switching to lstat(), implementing O_NOFOLLOW flags, and enforcing strict read size checks.
Affected products
- mcdope pam_usb < 0.8.7
Timeline
- 2026-05-07: advisory: GitHub security advisory published by maintainer
- 2026-05-27: disclosed: CVE published to NVD
- 2026-05-27: patched: Fix released in version 0.8.7