CVE-2010-3316: Low severity suse pam vulnerability
The runcoprocess function in pamxauth.c in the pamxauth module in Linux-PAM (aka pam) before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pamxauth PAM check.
Other sources
Tim Brown reported [1] a minor security flaw in pamxauth where the runcoprocess() function, which is responsible for running 'xauth nlist' as the existing user and 'xauth merge' as the target user does not check the return code on the setuid() call. An attacker with the ability to manipulate the number of processes running on the target account can cause RLIMITNPROC to be breached when runcoprocess() is called to execute 'xauth merge' as the target user.
This issue was assigned the name CVE-2010-3316 [2] and is corrected in Linux-PAM 1.1.2 [3].
It is not believed to be exploitable on current kernels, at least not via RLIMITNPROC [4].
[1] https://sourceforge.net/tracker/?func=detail&aid=3028213&groupid=6663&atid=106663 [2] http://www.openwall.com/lists/oss-security/2010/09/24/2 [3] http://git.altlinux.org/people/ldv/packages/?p=pam.git;a=commitdiff;h=06f882f30092a39a1db867c9744b2ca8d60e4ad6 [4] http://www.openwall.com/lists/oss-security/2010/09/21/11
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3316?
CVE-2010-3316 has a moderate severity rating due to the potential for local users to read arbitrary files.
How do I fix CVE-2010-3316?
To fix CVE-2010-3316, upgrade the Linux-PAM package to version 1.1.2 or later.
Which versions of Linux-PAM are affected by CVE-2010-3316?
CVE-2010-3316 affects Linux-PAM versions prior to 1.1.2, including all versions from 0.99 up to 1.1.1.
What is the main issue with CVE-2010-3316?
The main issue with CVE-2010-3316 is that the run_coprocess function does not properly check return values of certain system calls.
Can CVE-2010-3316 be exploited remotely?
CVE-2010-3316 cannot be exploited remotely as it requires local user access to the affected system.