CVE-2015-3238: Infoleak
From the original report: "If SELinux is enabled, the unixrunhelperbinary function in Linux-PAM 1.1.8 and earlier hangs indefinitely when verifying a password of 65536 characters, which allows attackers to conduct username enumeration and denial of service attacks.
When supplying a password of 65536 characters or more, the process will block on the write(2) call at modules/pamunix/support.c:614 because it tries to write strlen(passwd)+1 bytes to a blocking pipe and a pipe has a limited capacity of 65536 bytes on Linux."
Acknowledgements:
Red Hat would like to thank Sebastien Macke of Trustwave SpiderLabs for reporting this issue.
Other sources
The unixrunhelperbinary function in the pamunix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3238?
CVE-2015-3238 is a medium severity vulnerability that can lead to denial of service and username enumeration attacks.
How do I fix CVE-2015-3238?
To fix CVE-2015-3238, update Linux-PAM to version 1.1.9 or later, which addresses the vulnerability.
Who is affected by CVE-2015-3238?
CVE-2015-3238 affects systems running Linux-PAM versions 1.1.8 and earlier as well as Oracle SPARC OPL Service Processor with version 1121 or earlier.
What type of attacks can CVE-2015-3238 facilitate?
CVE-2015-3238 can facilitate username enumeration and denial of service attacks through password verification vulnerabilities.
How does CVE-2015-3238 exploit SELinux?
CVE-2015-3238 exploits SELinux by hanging the _unix_run_helper_binary function when processing overly long passwords.