pam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruption
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.9epss 0.2%
exploitation probability
0.2%top 94% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, symlink attacks on pad directory and pad files enable authentication bypass and root file corruption. This vulnerability is fixed in 0.8.7.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H
Affected products
mcdope · pam_usbpublic PoCs found — 1
cve_referencegithub.com/uniget-org/cli/security/advisories/GHSA-qqq4-5773-pmw5unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.