Executive brief
pam_usb is a Linux authentication module that allows users to log in using removable USB devices instead of passwords. A flaw in how the software tracks system processes can cause it to enter an infinite loop, effectively freezing the login process. This results in a denial-of-service where services like SSH, sudo, or local login become unresponsive and must be manually terminated by an administrator.
Technical details
An infinite loop vulnerability (CWE-835) exists in pam_usb's process-tree walking logic. The function `usb_get_process_parent_id()` fails to initialize the parent PID pointer on failure. In `pusb_local_login()`, the same variable is used for both input and output in a while loop; if a parent process exits during authentication, `/proc/<pid>/stat` becomes unreadable, causing the function to fail without updating the PID. This results in the loop condition never being met, hanging the PAM-aware process (e.g., sshd, sudo). The issue is fixed in version 0.9.2 by ensuring the PID is initialized to zero on failure.
Affected products
- mcdope pam_usb <= 0.9.1
Timeline
- 2026-05-23: patched: Version 0.9.2 released
- 2026-05-24: advisory: GitHub Security Advisory published
- 2026-06-18: disclosed: CVE published to NVD