Executive brief
pam_usb is a tool that allows users to log into Linux systems using a standard USB flash drive as a security key. A flaw in how it handles security data could allow two simultaneous login attempts to interfere with each other, potentially causing login failures or allowing an attacker to bypass security protections that prevent the reuse of old authentication data. This could lead to unauthorized access if an attacker can precisely time their actions during a login event.
Technical details
A race condition (CWE-362) exists in pam_usb's one-time pad (OTP) update mechanism within `src/pad.c`. When updating the OTP file, the application creates a temporary file using `open()` without the `O_EXCL` flag, making the operation non-atomic. If two concurrent processes attempt to update the same pad, they may both succeed in opening the file, leading to one write silently overwriting the other. Because the OTP is the primary mechanism for replay prevention, a successful race can cause the stored pad to diverge from expected values, resulting in authentication failures or a window for pad reuse. This requires local access and high timing precision to exploit. The issue is fixed in version 0.9.2 by adding `O_EXCL` to the file creation flags.
Affected products
- mcdope pam_usb < 0.9.2
Timeline
- 2026-05-23: patched: Version 0.9.2 released
- 2026-05-24: advisory: GitHub Security Advisory published
- 2026-06-18: disclosed: CVE-2026-48982 published to NVD