Executive brief
pam_usb is a tool that allows users to log into Linux systems using a USB drive as a physical security key. A security flaw in how it handles internal folders could allow a local attacker to intercept security data or block legitimate users from logging in. This could lead to unauthorized access to sensitive authentication codes or a disruption of the login process.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) race condition exists in src/pad.c of pam_usb. The software uses a check-then-act pattern, calling lstat() to verify a directory's existence before calling mkdir() to create it. A local attacker can exploit this window to replace the target path with a symbolic link to a directory they control. If successful, the application may write one-time pad (OTP) files into the attacker's directory, allowing the attacker to read future authentication pads (High Confidentiality impact) or prevent successful authentication (Low Availability/Integrity impact). The vulnerability is fixed in version 0.9.2 by replacing the lstat/mkdir sequence with a direct mkdir call that handles EEXIST.
Affected products
- mcdope pam_usb < 0.9.2
Timeline
- 2026-05-23: patched: Version 0.9.2 released
- 2026-05-24: advisory: GitHub Security Advisory published
- 2026-06-18: disclosed: CVE published to NVD