GHSA-gc4c-v52c-2v34: pam_usb: deny_remote bypassed by compressed IPv6 addresses in pusb_tmux_has_remote_clients
pamusb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the denyremote feature in pamusb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusbtmuxhasremoteclients() (src/tmux.c), the IPv6 detection regex required exactly four explicit colon-separated groups of 1-4 hex digits (e.g. 2001:0db8:85a3:0000). Any IPv6 address in compressed notation — including loopback (::1), link-local (fe80::1), and global unicast addresses (2001:db8::1) — did not match this pattern. As a result the remote-client check silently returned "no remote clients" even when a remote tmux client was connected from such an address. This issue has been patched in version 0.9.3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pam_usbto a version that resolves this vulnerability.Fixed in 0.9.3
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using pam_usb versions 0.8.0 through versions before 0.9.3 are affected if they rely on the deny_remote feature to block authentication when the user has an active remote tmux client.
What does an attacker need to bypass the remote-client check?
A remote tmux client connection whose IPv6 address is expressed in compressed notation can evade detection. This includes addresses such as ::1, fe80::1, and 2001:db8::1; the vulnerable check reports no remote clients for those addresses.
Is the deny_remote feature reliably protective on affected versions?
No. On affected versions, deny_remote can silently fail to identify remote tmux clients using compressed IPv6 addresses, allowing authentication to proceed despite the intended restriction.
What version resolves the issue?
Upgrade pam_usb to version 0.9.3, which includes the patch for compressed IPv6 address detection.