CVE-2024-22365 - Vulnerability Details - OpenCVE

ReportizFlow

linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux-pam	Linux-pam
Redhat	Enterprise Linux

Configuration 1 [-]

cpe:2.3:a:linux-pam:linux-pam:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
pam-0:1.3.1-33.el8	cpe:/o:redhat:enterprise_linux:8	RHSA-2024:3163	2024-05-22T00:00:00Z
Red Hat Enterprise Linux 9
pam-0:1.5.1-19.el9	cpe:/a:redhat:enterprise_linux:9	RHSA-2024:2438	2024-04-30T00:00:00Z
pam-0:1.5.1-19.el9	cpe:/o:redhat:enterprise_linux:9	RHSA-2024:2438	2024-04-30T00:00:00Z

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/01/18/3
https://github.com/linux-pam/linux-pam
https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb
https://github.com/linux-pam/linux-pam/releases/tag/v1.6.0
https://nvd.nist.gov/vuln/detail/CVE-2024-22365
https://www.cve.org/CVERecord?id=CVE-2024-22365
https://www.openwall.com/lists/oss-security/2024/01/18/3

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-02-06T00:00:00

Updated: 2024-08-01T22:43:34.704Z

Reserved: 2024-01-09T00:00:00

Link: CVE-2024-22365

Vulnrichment

Updated: 2024-08-01T22:43:34.704Z

NVD

Status : Modified

Published: 2024-02-06T08:15:52.203

Modified: 2024-11-21T08:56:07.760

Link: CVE-2024-22365

Redhat

Severity : Moderate

Publid Date: 2024-01-18T00:00:00Z

Links: CVE-2024-22365 - Bugzilla

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linux-pam:linux-pam:*:*:*:*:*:*:*:*", "matchCriteriaId": "8B735A60-FB87-4597-BFF4-A6ED201E71A1", "versionEndExcluding": "1.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY."}, {"lang": "es", "value": "linux-pam (tambi\u00e9n conocido como Linux PAM) anterior a 1.6.0 permite a los atacantes provocar una denegaci\u00f3n de servicio (proceso de inicio de sesi\u00f3n bloqueado) a trav\u00e9s de mkfifo porque la llamada openat (para protect_dir) carece de O_DIRECTORY."}], "id": "CVE-2024-22365", "lastModified": "2024-11-21T08:56:07.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2024-02-06T08:15:52.203", "references": [{"source": "[email protected]", "tags": ["Exploit", "Mailing List", "Patch", "Release Notes"], "url": "http://www.openwall.com/lists/oss-security/2024/01/18/3"}, {"source": "[email protected]", "tags": ["Product"], "url": "https://github.com/linux-pam/linux-pam"}, {"source": "[email protected]", "tags": ["Patch"], "url": "https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb"}, {"source": "[email protected]", "tags": ["Release Notes"], "url": "https://github.com/linux-pam/linux-pam/releases/tag/v1.6.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mailing List", "Patch", "Release Notes"], "url": "http://www.openwall.com/lists/oss-security/2024/01/18/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://github.com/linux-pam/linux-pam"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/linux-pam/linux-pam/releases/tag/v1.6.0"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "[email protected]", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:3163", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "pam-0:1.3.1-33.el8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-05-22T00:00:00Z"}, {"advisory": "RHSA-2024:2438", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "pam-0:1.5.1-19.el9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-04-30T00:00:00Z"}, {"advisory": "RHSA-2024:2438", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "pam-0:1.5.1-19.el9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-04-30T00:00:00Z"}], "bugzilla": {"description": "pam: allowing unprivileged user to block another user namespace", "id": "2257722", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2257722"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-277", "details": ["linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "A vulnerability was found in Linux PAM. An unprivileged user that is not yet in a corresponding mount namespace with ~/tmp mounted as a polyinstantiated dir can place a FIFO there, and a subsequent attempt to login as this user with `pam_namespace` configured will cause the `openat()` in `protect_dir()` to block the attempt, causing a local denial of service."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-22365", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "pam", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2024-01-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-22365\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-22365\nhttps://www.openwall.com/lists/oss-security/2024/01/18/3"], "statement": "Red Hat rates this as Moderate, as this vulnerability needs a non-default configuration in order to be explored by a malicious user. Also, the attack is local and the Denial of Service happens to a single user.", "threat_severity": "Moderate", "upstream_fix": "pam 1.6.0"}