Executive brief
pam_usb is a Linux tool that allows users to log in using a USB flash drive instead of a password. A security flaw was found where the software fails to properly erase sensitive authentication data, such as one-time pad keys, from the computer's memory after use. If an attacker already has limited access to the system, they might be able to recover this leftover data to bypass security measures or gain unauthorized access.
Technical details
A vulnerability exists in the xfree() memory release helper within src/mem.c of pam_usb. The function calls free() without first zeroing the buffer contents, leading to sensitive data (including one-time pad bytes) lingering in heap memory. An attacker with local access could potentially recover this material if a use-after-free condition exists or if they can utilize a heap inspection primitive. The issue is addressed in version 0.9.2 by implementing explicit_bzero() within the xfree() helper to ensure memory is cleared before being returned to the system.
Affected products
- mcdope pam_usb <= 0.9.1
Timeline
- 2026-05-23: patched: Version 0.9.2 released with security hardening fixes.
- 2026-05-24: advisory: GitHub Security Advisory GHSA-rmp6-wfrq-wrrc published.
- 2026-06-18: disclosed: CVE-2026-48984 published to the NVD.