CVE-2024-22365
MediumSummary
A vulnerability in Linux PAM before version 1.6.0 allows attackers to cause a denial of service by blocking the login process. The issue stems from the lack of the O_DIRECTORY flag in the openat call for the protect_dir function, enabling the use of mkfifo.
Risk Assessment
An attacker can block the login process for users, leading to system unavailability for authorized individuals.
Recommendation
It is recommended to upgrade Linux PAM to version 1.6.0 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Linux PAM
See all- CVE-2026-54411Medium
Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path, allowing a local or network-adjacent attacker to recover the plaintext password of a target account by measuring response-timing differences.
- CVE-2025-6020High
A vulnerability was found in the pam_namespace module of linux-pam, where user-controlled paths are not properly protected. A local attacker can exploit symlink attacks and race conditions to escalate privileges to root.
Original NVD description (English source)
linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS