CVE-2025-24031: PAM-PKCS#11 vulnerable to segmentation fault on ctrl-c/ctrl-d when asked for PIN
First published: Mon Feb 10 2025(Updated: )
PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. In versions 0.6.12 and prior, the pam_pkcs11 module segfaults when a user presses ctrl-c/ctrl-d when they are asked for a PIN. When a user enters no PIN at all, `pam_get_pwd` will never initialize the password buffer pointer and as such `cleanse` will try to dereference an uninitialized pointer. On my system this pointer happens to have the value 3 most of the time when running sudo and as such it will segfault. The most likely impact to a system affected by this issue is an availability impact due to a daemon that uses PAM crashing. As of time of publication, a patch for the issue is unavailable.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PAM-PKCS#11 | <0.6.12 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/OpenSC/pam_pkcs11/security/advisories/GHSA-wvr3-c9x3-9mff
- https://github.com/OpenSC/pam_pkcs11/blob/bb2e3f3a95e44fdf44b0d5a4b377db3179021380/src/pam_pkcs11/pam_pkcs11.c#L211
- https://github.com/OpenSC/pam_pkcs11/blob/bb2e3f3a95e44fdf44b0d5a4b377db3179021380/src/pam_pkcs11/pam_pkcs11.c#L797
Frequently Asked Questions
What is the severity of CVE-2025-24031?
CVE-2025-24031 is considered a moderate severity vulnerability due to the potential for denial of service caused by the segfault.
How does CVE-2025-24031 affect PAM-PKCS#11?
CVE-2025-24031 affects PAM-PKCS#11 versions 0.6.12 and prior by causing a segfault when the user fails to provide a PIN.
How do I fix CVE-2025-24031?
To fix CVE-2025-24031, update your PAM-PKCS#11 module to version 0.6.13 or later.
What happens if a user presses ctrl-c or ctrl-d during a PIN prompt in CVE-2025-24031?
Pressing ctrl-c or ctrl-d during a PIN prompt may cause the PAM-PKCS#11 module to segfault, leading to a denial of service.
Are there any workarounds for CVE-2025-24031?
As a workaround for CVE-2025-24031, users can avoid pressing ctrl-c or ctrl-d during the PIN prompt until the module is updated.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/epss
- agent/tags
- vendor/pam-pkcs#11
- canonical/pam-pkcs#11