CVE-2024-22365

Medium

Published: —Translated: 06/07/2026(UTC)NVD NIST

Summary

A vulnerability in Linux PAM before version 1.6.0 allows attackers to cause a denial of service by blocking the login process. The issue stems from the lack of the O_DIRECTORY flag in the openat call for the protect_dir function, enabling the use of mkfifo.

Risk Assessment

An attacker can block the login process for users, leading to system unavailability for authorized individuals.

Recommendation

It is recommended to upgrade Linux PAM to version 1.6.0 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.