CVE-2026-47269
HighSummary
In versions prior to 0.9.0, the deny_remote feature in pam_usb incorrectly checked whether an authentication request originated from a remote session, allowing security bypass. An attacker with physical access to a registered USB device could authenticate over SSH as if they were locally connected.
Risk Assessment
Organizations may be exposed to unauthorized access to systems if an attacker gains physical access to a registered USB device. This poses a serious threat to data and system security.
Recommendation
It is recommended to update pam_usb to version 0.9.0 or later to fix this vulnerability. Additionally, consider implementing further security measures, such as restricting physical access to USB devices.
Other vulnerabilities in pam_usb
See all- CVE-2026-48983Medium
In versions prior to 0.9.2, pam_usb has a symlink race condition in per-device and per-user pad directory creation. A local attacker can exploit this vulnerability by replacing the target path with a symlink to a directory they control.
- CVE-2026-48981Medium
In versions prior to 0.9.2, pam_usb calls xmlReadFile() with flags=0 when loading the configuration file, allowing libxml2 to process external entity references (XXE). This can lead to outbound network connections or local file reads at XML parse time from the context of the authenticating process.
- CVE-2026-48980Medium
In versions prior to 0.9.2, the pam_usb module, responsible for hardware authentication on Linux, is vulnerable to environment variable injection. The XRDP_SESSION, DISPLAY, and TMUX variables can be manipulated by a local user, affecting the local and remote session checking logic.
- CVE-2026-48986Medium
In pam_usb versions 0.9.1 and earlier, a bug can lead to an infinite loop DoS due to improper initialization of the *ppid variable. In the pusb_local_login() function, the same variable is reused as input and output in a loop, which can cause the authenticating process to hang.
- CVE-2026-48985Medium
In versions 0.9.1 and below, the pam_usb module can cause a NULL dereference crash when parsing loginctl output. The pusb_is_loginctl_local() function calls popen() and reads the result, which can lead to undefined behavior and crashing the PAM module.
- CVE-2026-48984Medium
In versions 0.9.1 and below, the xfree() function in pam_usb releases memory without first zeroing the buffer contents, leading to the exposure of sensitive data in freed memory. This could allow recovery of pad values or other authentication material from freed memory regions.
- CVE-2026-44713High
In versions prior to 0.8.7, pam_usb reads the user's $TMUX environment variable and interpolates its value without proper sanitization, allowing arbitrary shell syntax injection. This creates a risk of unauthorized command execution as root.
- CVE-2026-44712High
pam_usb prior to version 0.8.7 allows remote code execution (RCE) as root through a crafted UUID in the configuration. Running pamusb-conf --reset-pads with such a UUID leads to exploitation of the vulnerability.
- CVE-2026-44711High
pam_usb prior to version 0.8.7 is vulnerable to symlink attacks that allow authentication bypass and root file corruption. Version 0.8.7 includes a fix for this vulnerability.
- CVE-2026-47272High
In versions prior to 0.9.0, the pusb_pad_compare() function in pam_usb did not enforce the presence and readability of the pad file on the USB device, allowing users to authenticate without the physical device. A user could delete their ~/.pamusb/device.pad, resulting in successful authentication without the required USB device.
Original NVD description (English source)
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb's deny_remote feature checks utmpx ut_addr_v6 to detect whether an authentication request originates from a remote session. The outer guard was if (utent->ut_addr_v6[0] != 0), which only tests the first 32-bit word of the 128-bit address field. IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) store the IPv4 address in ut_addr_v6[3] with ut_addr_v6[0] == 0. On systems where the SSH daemon listens on :: (IPv6 wildcard) with AddressFamily any -- common on Ubuntu and Debian -- incoming IPv4 connections are recorded in utmpx as IPv4-mapped IPv6 addresses. The outer check evaluates to false, the remote-detection block is skipped entirely, and the session is treated as local. deny_remote=true does not block the authentication. An attacker with physical access to a registered USB device can authenticate over SSH on an affected system as if they were sitting at a local terminal, bypassing the