CVE-2024-22365

linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.

linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.

linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.

PAM (Pluggable Authentication Modules) is a system of libraries that handle the authentication tasks of applications (services) on the system.

Security Fix(es):

A vulnerability was found in Linux PAM. An unprivileged user that is not yet in a corresponding mount namespace with ~/tmp mounted as a polyinstantiated dir can place a FIFO there, and a subsequent attempt to login as this user with pam_namespace configured will cause the openat() in protect_dir() to block the attempt, causing a local denial of service.(CVE-2024-22365)

PAM (Pluggable Authentication Modules) is a system of libraries that handle the authentication tasks of applications (services) on the system.

Security Fix(es):

A vulnerability was found in Linux PAM. An unprivileged user that is not yet in a corresponding mount namespace with ~/tmp mounted as a polyinstantiated dir can place a FIFO there, and a subsequent attempt to login as this user with pam_namespace configured will cause the openat() in protect_dir() to block the attempt, causing a local denial of service.(CVE-2024-22365)

PAM (Pluggable Authentication Modules) is a system of libraries that handle the authentication tasks of applications (services) on the system.

Security Fix(es):

A vulnerability was found in Linux PAM. An unprivileged user that is not yet in a corresponding mount namespace with ~/tmp mounted as a polyinstantiated dir can place a FIFO there, and a subsequent attempt to login as this user with pam_namespace configured will cause the openat() in protect_dir() to block the attempt, causing a local denial of service.(CVE-2024-22365)

Root has patched CVE-2024-22365 in the linux-pam package for Root:Alpine:3.18. Multiple fixed versions available.

linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

• pam: allowing unprivileged user to block another user namespace (CVE-2024-22365)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

• pam: allowing unprivileged user to block another user namespace (CVE-2024-22365)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• SECURITY UPDATE: denial of service (blocked login process) via mkfifo
  • debian/patches-applied/CVE-2024-22365.patch: pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS situations
  • CVE-2024-22365

• Backport 031bb5a5d0d950253b68138b498dc93be69a64cb: fix CVE-2024-22365
  • debian/patches-applied/CVE-2024-22365.patch: pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS situations
  • CVE-2024-22365

• CVE-2024-22365: pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS situations

• CVE-2024-22365: use O_DIRECTORY to prevent local DoS situations

• CVE-2024-22365: use O_DIRECTORY to prevent local DoS situations

• CVE-2024-10041: fix possibility of leakage of secret information stored in memory
• CVE-2024-22365: fix potential DoS via mkfifo because the openat call lacks O_DIRECTORY

• CVE-2024-10041: fix possibility of leakage of secret information stored in memory
• CVE-2024-22365: fix potential DoS via mkfifo because the openat call lacks O_DIRECTORY

• Rebase onto the vendor's 1.1.8-23.0.3 sources
• CVE-2024-10041: fix possibility of leakage of secret information stored in memory
• CVE-2025-6020: take the vendor's fix and carry the parts of ours it omits: upstream 976c2007, namespace.init path-safety flags, helper fd sanitizing
• CVE-2024-22365 is now fixed by the vendor's pam_namespace rewrite, which replaces protect_dir() with secure_opendir(); the TuxCare duplicate is dropped

• Rebase onto the vendor's 1.1.8-23.0.3 sources
• CVE-2024-10041: fix possibility of leakage of secret information stored in memory
• CVE-2025-6020: take the vendor's fix and carry the parts of ours it omits: upstream 976c2007, namespace.init path-safety flags, helper fd sanitizing
• CVE-2024-22365 is now fixed by the vendor's pam_namespace rewrite, which replaces protect_dir() with secure_opendir(); the TuxCare duplicate is dropped

• Rebase onto the vendor's 1.1.8-23.0.3 sources
• CVE-2024-10041: fix possibility of leakage of secret information stored in memory
• CVE-2025-6020: take the vendor's fix and carry the parts of ours it omits: upstream 976c2007, namespace.init path-safety flags, helper fd sanitizing
• CVE-2024-22365 is now fixed by the vendor's pam_namespace rewrite, which replaces protect_dir() with secure_opendir(); the TuxCare duplicate is dropped

The updated packages fix a security vulnerability: pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS situations. (CVE-2024-22365)

These are all security issues fixed in the pam-1.6.0-1.1 package on the GA media of openSUSE Tumbleweed.

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

• pam: allowing unprivileged user to block another user namespace (CVE-2024-22365)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

Root has patched CVE-2024-22365 in the rootio-linux-pam package for Root:Alpine:3.19. Multiple fixed versions available.

Root has patched CVE-2024-22365 in the rootio-pam package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2024-22365 in the rootio-pam package for Root:Debian:12. Multiple fixed versions available.

This update for pam fixes the following issues:

• CVE-2024-22365: Fixed a local denial of service during PAM login due to a missing check during path manipulation (bsc#1218475).
• Check localtime_r() return value to fix crashing (bsc#1217000)

This update for pam fixes the following issues:

• CVE-2024-22365: Fixed a local denial of service during PAM login due to a missing check during path manipulation (bsc#1218475).
• Check localtime_r() return value to fix crashing (bsc#1217000)

This update for pam fixes the following issues:

• CVE-2024-22365: Fixed a local denial of service during PAM login due to a missing check during path manipulation (bsc#1218475).

Matthias Gerstner discovered that the PAM pam_namespace module incorrectly handled special files when performing directory checks. A local attacker could possibly use this issue to cause PAM to stop responding, resulting in a denial of service.

USN-6588-1 fixed a vulnerability in PAM. This update provides the corresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.

Original advisory details:

Matthias Gerstner discovered that the PAM pam_namespace module incorrectly handled special files when performing directory checks. A local attacker could possibly use this issue to cause PAM to stop responding, resulting in a denial of service.