CVE-2024-22365: pam: pam_namespace misses O_DIRECTORY flag in `protect_dir()` (CVE-2024-22365)
linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protectdir) lacks ODIRECTORY.
Other sources
Linux-pam is vulnerable to a denial of service, caused by a flaw in pamnamespace.so. By sending a specially crafted request, a local attacker could exploit this vulnerability to cause a denial of service.
— IBM
The pamnamespace module allows to setup "polyinstantiated directories" when setting up a user's session during login. The typical example is setting up a private /tmp and/or /var/tmp for every user. To achieve this a separate mount namespace is setup during login and a bind mount is performed in configured locations. Different methods are offered for this like a fixed per-user directory that is bind mounted (i.e. per-user contents are persistent and shared between sessions) or an ephemeral temporary directory (contents are lost after a session is closed).
The PAM module explicitly supports bind mounting of polyinstantiated directories in user controlled locations, like beneath the user's home directory. Operating with root privileges in user controlled directories comes with a lot of dangers. To avoid them the function protectdir() implements a special algorithm to protect the target path of a bind mount.
The function follows the target path for the bind mount starting from the file system root. Each path component that is under non-root control is protected from user manipulation, by bind mounting the path upon itself.
There is one bit missing though: The algorithm is not passing the ODIRECTORY flag to openat() and is thus subject to special files like FIFOs being placed in user controlled directories. This can easily be reproduced e.g. using this configuration entry in the namespace.conf configuration file:
$HOME/tmp /var/tmp/tmp-inst/ user:create root
An unprivileged user (that is not yet in a corresponding mount namespace with ~/tmp mounted as a polyinstantiated dir) can now place a FIFO there:
nobody$ mkfifo $HOME/tmp
A subsequent attempt to login as this user with pamnamespace configured will cause the openat() in protectdir() to block, causing a local denial of service.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/pamto a version that resolves this vulnerability.Fixed in 1.5.3-7 - Upgrade
Upgrade
ubuntu/pamto a version that resolves this vulnerability.Fixed in 1.1.8-3.6ubuntu2.18.04.6+ - Upgrade
Upgrade
ubuntu/pamto a version that resolves this vulnerability.Fixed in 1.3.1-5ubuntu4.7 - Upgrade
Upgrade
ubuntu/pamto a version that resolves this vulnerability.Fixed in 1.4.0-11ubuntu2.4 - Upgrade
Upgrade
ubuntu/pamto a version that resolves this vulnerability.Fixed in 1.5.2-5ubuntu1.1 - Upgrade
Upgrade
ubuntu/pamto a version that resolves this vulnerability.Fixed in 1.5.2-6ubuntu1.1 - Upgrade
Upgrade
ubuntu/pamto a version that resolves this vulnerability.Fixed in 1.1.8-1ubuntu2.2+ - Upgrade
Upgrade
ubuntu/pamto a version that resolves this vulnerability.Fixed in 1.1.8-3.2ubuntu2.3+ - Upgrade
Upgrade
redhat/pamto a version that resolves this vulnerability.Fixed in 1.6.0 - Upgrade
Upgrade
linux-pam (aka Linux PAM)to a version that resolves this vulnerability.Fixed in 1.6.0 - Configuration
Update/patch pam_namespace.so so that protect_dir() passes the O_DIRECTORY flag to openat(); this prevents denial-of-service/blocking of login caused by special files (e.g., FIFOs) placed in user-controlled locations (CVE-2024-22365).
pam_namespace (Linux-PAM) O_DIRECTORY flag in protect_dir()/openat() algorithm = Ensure openat() is called with O_DIRECTORY to avoid blocking on special files like FIFOs - Configuration
Configure pam_namespace to bind mount each user’s private /tmp and/or /var/tmp (ephemeral temporary directory contents lost after session close) rather than using user-controlled directories under non-root control.
pam_namespace namespace.conf Bind-mounted polyinstantiated directories location = Use a per-user private /tmp and/or /var/tmp - Compensating control
If feasible while fixing, avoid setting up pam_namespace polyinstantiated directories that allow user-controlled paths where attackers can place special files (e.g., FIFOs) that interfere with protect_dir() behavior.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2024-22365?
CVE-2024-22365 has a severity rating that indicates a potential denial of service vulnerability that affects login processes.
How do I fix CVE-2024-22365?
To fix CVE-2024-22365, upgrade to Linux PAM version 1.6.0 or later.
Which versions of Linux PAM are affected by CVE-2024-22365?
Linux PAM versions before 1.6.0 are affected by CVE-2024-22365.
What kind of attack does CVE-2024-22365 enable?
CVE-2024-22365 enables attackers to cause a denial of service by blocking the login process.
Is there a workaround for CVE-2024-22365 if I cannot upgrade?
Currently, there are no known workarounds for CVE-2024-22365, so upgrading is recommended.