Linux PAM vulnerabilities

A vulnerability in Linux PAM before version 1.6.0 allows attackers to cause a denial of service by blocking the login process. The issue stems from the lack of the O_DIRECTORY flag in the openat call for the protect_dir function, enabling the use of mkfifo.

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path, allowing a local or network-adjacent attacker to recover the plaintext password of a target account by measuring response-timing differences.

A vulnerability was found in the pam_namespace module of linux-pam, where user-controlled paths are not properly protected. A local attacker can exploit symlink attacks and race conditions to escalate privileges to root.