CVE-2026-64667: pam_usb: Heap out-of-bounds read in pusb_get_tty_from_display_server cmdline scan
pamusb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c (pusbgetttyfromdisplayserver) allocates a 4096-byte cmdline buffer, reads up to 4096 bytes from /proc//cmdline, then replaces every NUL separator with a space. When read(2) returns exactly 4096 bytes for any process the function inspects, the buffer ends without a terminator and the subsequent strstr() calls scan past the allocation boundary. The function is invoked during normal PAM authentication when DISPLAY is set, so the read fires for every process at auth time. Consequences are bounded: strstr output is a Boolean substring match (limited info-disclosure surface) but a hostile heap layout can produce a SIGSEGV that terminates the host PAM process. This issue has been patched in version 0.9.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pam_usbto a version that resolves this vulnerability.Fixed in 0.9.3
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using pam_usb versions before 0.9.3 are affected when normal PAM authentication occurs with the DISPLAY environment variable set. The vulnerable function inspects process command lines during that authentication flow.
What conditions are needed to trigger the out-of-bounds read?
At least one process inspected by the function must have a /proc/<pid>/cmdline value for which read(2) returns exactly 4096 bytes. The authentication must also run with DISPLAY set.
What is the practical impact of successful exploitation?
The out-of-bounds strstr() scan has a limited information-disclosure surface because its result is only a Boolean substring match. With a hostile heap layout, it can also cause a SIGSEGV that terminates the host PAM process.
How can I remediate the issue?
Upgrade pam_usb to version 0.9.3, which includes the patch.