Executive brief
pam_usb is a tool that allows users to log into Linux systems using a standard USB drive as a physical security key. A vulnerability in how the software handles device identifiers and usernames allows an attacker to execute malicious commands with root-level privileges. This could occur if a user connects a specially prepared USB device or if an attacker modifies the system's configuration file, potentially leading to a full system takeover.
Technical details
Two command injection vulnerabilities exist in the Python helper tools of pam_usb. In 'pamusb-conf', the device UUID is read from the XML configuration and interpolated into a shell command via 'subprocess.check_output' with 'shell=True'. In 'pamusb-agent', the 'userName' variable from the configuration is passed directly to 'os.system()'. An attacker with physical access can provide a USB device with a malicious filesystem UUID (e.g., containing shell metacharacters) to trigger execution during device setup, or an attacker with high privileges can modify the XML configuration to achieve a scope change and execute arbitrary commands as root. The issue is fixed in version 0.8.7 by implementing UUID validation and migrating to 'subprocess.run' without shell interpolation.
Affected products
- mcdope pam_usb < 0.8.7
Timeline
- 2026-05-07: advisory: GitHub advisory published by maintainer
- 2026-05-27: disclosed: CVE published to NVD