Executive brief
pam_usb is a tool that allows users to log into Linux systems using a USB flash drive as a physical key. A flaw in how the software processes login information can cause the authentication process to crash. This could prevent legitimate users from logging into the system or using administrative commands like sudo, potentially leading to a complete lockout from the affected service.
Technical details
A NULL pointer dereference exists in the pusb_is_loginctl_local() function within src/local.c of pam_usb. The vulnerability occurs when the function parses output from loginctl; if the 'Remote' field contains only a newline character, fgets() succeeds but a subsequent strtok_r() call returns NULL. The code then passes this NULL pointer to strcmp(), causing a SIGSEGV. An attacker with local access could trigger this condition to crash authentication processes such as sudo or login, leading to a denial of service. This issue is fixed in version 0.9.2.
Affected products
- mcdope pam_usb <= 0.9.1
Timeline
- 2026-05-23: patched: Version 0.9.2 released
- 2026-05-24: advisory: GitHub Security Advisory published
- 2026-06-18: disclosed: CVE published to NVD