UBUNTU-CVE-2025-24031

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2025-24031
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-24031.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2025-24031
Related
Published
2025-02-10T16:15:00Z
Modified
2025-02-13T04:30:51Z
Summary
[none]
Details

PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. In versions 0.6.12 and prior, the pam_pkcs11 module segfaults when a user presses ctrl-c/ctrl-d when they are asked for a PIN. When a user enters no PIN at all, pam_get_pwd will never initialize the password buffer pointer and as such cleanse will try to dereference an uninitialized pointer. On my system this pointer happens to have the value 3 most of the time when running sudo and as such it will segfault. The most likely impact to a system affected by this issue is an availability impact due to a daemon that uses PAM crashing. As of time of publication, a patch for the issue is unavailable.

References

Affected packages

Ubuntu:Pro:16.04:LTS / pam-pkcs11

Package

Name
pam-pkcs11
Purl
pkg:deb/ubuntu/pam-pkcs11@0.6.8-4?arch=source&distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.6.8-4

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / pam-pkcs11

Package

Name
pam-pkcs11
Purl
pkg:deb/ubuntu/pam-pkcs11@0.6.9-2build2?arch=source&distro=esm-apps/bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.6.9-1
0.6.9-2
0.6.9-2build1
0.6.9-2build2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / pam-pkcs11

Package

Name
pam-pkcs11
Purl
pkg:deb/ubuntu/pam-pkcs11@0.6.11-2?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.6.11-2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:22.04:LTS / pam-pkcs11

Package

Name
pam-pkcs11
Purl
pkg:deb/ubuntu/pam-pkcs11@0.6.11-4build2?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.6.11-4build1
0.6.11-4build2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.10 / pam-pkcs11

Package

Name
pam-pkcs11
Purl
pkg:deb/ubuntu/pam-pkcs11@0.6.12-2build3?arch=source&distro=oracular

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.6.12-2build3

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / pam-pkcs11

Package

Name
pam-pkcs11
Purl
pkg:deb/ubuntu/pam-pkcs11@0.6.12-2build3?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.6.12-1
0.6.12-2
0.6.12-2build2
0.6.12-2build3

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}