Mcdope

pam usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDP SESSION with plain getenv(3) at the head of pusb local login while every other env consumer in the same function uses secure getenv(3). When pam usb.so loads into a setuid PAM host, the calling user controls the environment passed in. Clearing XRDP SESSION before invoking the host bypasses the explicit XRDP-deny rule. Other remote-detection signals (rmsvc, evdev, loginctl, utmp) may still catch the session, but the env-based detection alone is defeated. This issue has been patched in version 0.9.3.

pam usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c (pusb get tty from display server) allocates a 4096-byte cmdline buffer, reads up to 4096 bytes from /proc//cmdline, then replaces every NUL separator with a space. When read(2) returns exactly 4096 bytes for any process the function inspects, the buffer ends without a terminator and the subsequent strstr() calls scan past the allocation boundary. The function is invoked during normal PAM authentication when DISPLAY is set, so the read fires for every process at auth time. Consequences are bounded: strstr output is a Boolean substring match (limited info-disclosure surface) but a hostile heap layout can produce a SIGSEGV that terminates the host PAM process. This issue has been patched in version 0.9.3.

pam usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny remote feature in pam usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb tmux has remote clients() (src/tmux.c), the IPv6 detection regex required exactly four explicit colon-separated groups of 1-4 hex digits (e.g. 2001:0db8:85a3:0000). Any IPv6 address in compressed notation — including loopback (::1), link-local (fe80::1), and global unicast addresses (2001:db8::1) — did not match this pattern. As a result the remote-client check silently returned "no remote clients" even when a remote tmux client was connected from such an address. This issue has been patched in version 0.9.3.

A symlink race condition exists in the creation of per-device and per-user pad directories. The software employs a check-then-act pattern, where it calls `lstat()` to verify existence and subsequently calls `mkdir()` to create the directory. A local attacker can exploit the timing between these calls by replacing the target path with a symlink to a directory under their control. This may result in one-time pad files being written to an attacker-controlled location, which could expose future pad values or disrupt the authentication process.

The `xfree()` memory release helper calls `free()` without zeroing buffer contents first. This results in heap-allocated buffers containing sensitive data, such as one-time pad bytes read from disk, being released without being cleared. Consequently, sensitive content remains in freed heap memory until overwritten by a subsequent allocation. In scenarios where a heap inspection primitive is available or a use-after-free condition exists, this could allow the recovery of authentication material or pad values from freed memory regions.

An issue exists in the `pusb is loginctl local()` function where a NULL dereference crash can occur when parsing loginctl output. The function utilizes `popen()` to read results; if the Remote field contains only a newline, `fgets()` succeeds but `strtok r(buf, " ", &saveptr)` returns NULL. A subsequent `strcmp(is remote, "no")` then dereferences this NULL value, leading to undefined behavior, typically a SIGSEGV (segmentation fault), which crashes the PAM module. This can result in the crash of authenticating processes such as `sudo` or `login` and may deny access to all users of the affected service depending on the PAM stack configuration.

An infinite loop Denial of Service (DoS) occurs during the process-tree walk when a parent process exits during authentication. The function `usb get process parent id()` fails to initialize the `*ppid` variable upon failure. In the `pusb local login()` function, this variable is reused as both input and output within a while loop; if the system cannot read `/proc/<pid>/stat`, the PID is not updated, preventing the loop from terminating. This results in the authentication process, such as sudo, sshd, or login, hanging until it is forcibly terminated.

This software provides hardware authentication for Linux using removable media. A flaw exists where the `getenv()` function allows environment variable injection into local-check logic via the `XRDP SESSION`, `DISPLAY`, and `TMUX` variables. These variables determine if a session is local or remote. When a PAM module runs within the context of setuid binaries such as `sudo` or `su`, `getenv()` can return values controlled by a local user who has manipulated the process environment.

pam usb provides hardware authentication for Linux using removable media. The software calls the `xmlReadFile()` function with `flags=0` when loading the configuration file, which allows libxml2 to process external entity references. This can lead to XML External Entity (XXE) processing, where the system may perform local file reads or make outbound network connections during XML parsing from the context of the authenticating process. Exploitation requires the configuration file to contain crafted XML entity references. Because the configuration file is owned by root, write access to the file is necessary for exploitation; however, the impact is significant as the `pam usb.so` module operates in setuid contexts such as `sudo` and `su`.

This software provides hardware authentication for Linux using removable media. A race condition exists when updating a one-time pad file because a temporary file is created using the `open()` function without the `O EXCL` flag. This lack of atomicity allows two concurrent processes to open the same file, leading to the second write silently overwriting the first. Since the one-time pad is the primary replay-prevention mechanism, this divergence can cause authentication failures or create a window for pad reuse.

In `src/log.c`, a process-wide static pointer is written with the address of a stack-local variable during every PAM invocation. This behavior violates the PAM re-entrancy requirement—the ability of a function to be interrupted and safely called again before its previous invocation has finished—resulting in a data race when the PAM stack is invoked concurrently from multiple threads.

pam usb provides hardware authentication for Linux using removable media. The `pamusb-pinentry` component reads the `PINENTRY FALLBACK APP` environment variable and executes it without validation. A process capable of setting environment variables before `pamusb-pinentry` is invoked can point `PINENTRY FALLBACK APP` to an arbitrary binary or script, leading to execution with the privileges of the pam usb tool chain.

In `src/device.c`, the return values of the functions `udisks drive get serial()`, `udisks drive get vendor()`, and `udisks drive get model()` are passed directly to `strcmp()` without NULL checks. According to GIO/UDisks API documentation, these accessors can return NULL for devices that do not expose the corresponding field. Passing a NULL pointer to `strcmp()` results in undefined behavior, typically leading to a SIGSEGV (segmentation fault), which causes a PAM crash and a login denial-of-service.

In the `src/evdev.c` file, the `pusb has virtual input device()` function silently ignores EACCES errors when opening `/dev/input/event*` nodes. This behavior causes the function to return 0, indicating no virtual devices were found, even if all `open()` calls failed due to insufficient permissions. Consequently, the caller in `src/local.c` cannot differentiate between a genuine absence of virtual devices and a scan blocked by permission denials, leading the system to continue authentication without denying access. This effectively disables remote desktop detection during non-root execution.

An issue exists in the hardware authentication system for Linux where shell injection can occur. A crafted UUID in the configuration can lead to root remote code execution when the `pamusb-conf --reset-pads` command is executed. This payload can be injected during the `--add-device` process via a USB device with a crafted filesystem UUID. Additionally, the `userName` variable from the XML configuration is passed to the `os.system()` function in `pamusb-agent`, which invokes a shell.

In the `src/tmux.c` file, the software reads the `$TMUX` environment variable, splits it by commas, and interpolates the socket-path component directly into a shell command executed via the `popen()` function. Since the value is placed within double-quotes without proper sanitization, an attacker can use a double-quote character to terminate the string and inject arbitrary shell syntax. This process executes with root privileges within the PAM stack, potentially leading to remote code execution.

The `deny remote` feature incorrectly classifies IPv4-mapped IPv6 remote connections as local sessions. This occurs because the system checks the `ut addr v6` field of `utmpx` using a guard `if (utent->ut addr v6[0] != 0)`, which only validates the first 32-bit word of the 128-bit address field. IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) store the IPv4 address in `ut addr v6[3]` while `ut addr v6[0]` remains 0. On systems where the SSH daemon listens on the IPv6 wildcard (::) with AddressFamily any, such as common Ubuntu and Debian configurations, incoming IPv4 connections are recorded as IPv4-mapped IPv6 addresses. Consequently, the remote-detection block is skipped, and the session is treated as local, allowing the `deny remote=true` setting to be bypassed. An attacker with physical access to a registered USB device can authenticate over SSH as if they were at a local terminal.

This issue occurs in the `deny remote` feature of the PAM module, which is loaded into host processes such as sudo, login, GDM, and GNOME Shell. In multi-threaded environments like GDM, three functions utilize the non-reentrant `strtok()` function. Because `strtok()` stores state in a single global pointer, concurrent authentication threads can race, allowing one thread to overwrite another's tokenization pointer. This leads to incorrect parsing of `/proc` environment scans or tmux session data used for remote-session detection. Furthermore, the `pusb tmux get client tty()` function passes a raw pointer from `getenv(TMUX)` directly to `strtok()`. Since `strtok()` inserts NUL bytes into the live process environment block, the `TMUX` variable is permanently corrupted for all subsequent code in that process. Consequently, when `deny remote=true` is set, the system may make incorrect authentication decisions for either remote or local sessions depending on thread interleaving.

In `src/mem.c`, out-of-memory guards for the functions `xmalloc()`, `xrealloc()`, and `xstrdup()` were implemented using `assert(data != NULL)`. Because `assert()` expressions are compiled out when `NDEBUG` is defined during build time—a common practice in release and packaging builds for Debian, Fedora, and Arch—these guards are removed in such versions. Consequently, these functions return NULL upon allocation failure, which is then dereferenced without a check, leading to a NULL pointer dereference and a crash of the PAM module. This creates a local denial-of-service condition where an attacker inducing memory pressure during authentication can lock all users out of `sudo` and `login`.

The `pusb pad compare()` function in src/pad.c only verifies that the user-side pad (~/.pamusb/device.pad) is readable, without ensuring the system-side pad on the USB device is present and readable. If the user-side pad is deleted or unreadable, the function returns a failure that some code paths treat as non-fatal, allowing authentication to succeed without verifying the USB device. Consequently, a local user can delete their own `~/.pamusb/device.pad` to bypass the physical USB device requirement.