CVE-2022-28321
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module does not correctly restrict login when a user tries to connect from an IP address that is not resolvable via DNS — in such conditions, a user with denied access to a machine can still get access.
Risk Assessment
The vulnerability may allow a user who has been denied access to log in to the system via SSH, violating the access control policy. The issue is largely limited to openSUSE Tumbleweed and openSUSE Factory and does not affect Linux-PAM upstream.
Recommendation
Update the Linux-PAM package to version 1.5.2-6.1 or later on openSUSE Tumbleweed and openSUSE Factory systems. Review the pam_access.so configuration and verify that access rules work correctly for IP addresses not resolvable via DNS.
Other vulnerabilities in Linux-PAM
See all- CVE-2024-22365Medium
A vulnerability in Linux PAM before version 1.6.0 allows attackers to cause a denial of service by blocking the login process. The issue stems from the lack of the O_DIRECTORY flag in the openat call for the protect_dir function, enabling the use of mkfifo.
- CVE-2026-54411Medium
Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path, allowing a local or network-adjacent attacker to recover the plaintext password of a target account by measuring response-timing differences.
- CVE-2025-6020High
A vulnerability was found in the pam_namespace module of linux-pam, where user-controlled paths are not properly protected. A local attacker can exploit symlink attacks and race conditions to escalate privileges to root.
Original NVD description (English source)
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS