https://seclists.org/oss-sec/2024/q4/12: CVE-2024-47191: Local root exploit in the PAM module pam_oath.so
Published Oct 5, 2024
·Updated
Affected Software
1 affected component
OATH Toolkit pam_oath
Deployments are exposed when pam_oath is configured with a usersfile path that is not root-controlled and protected, including a path based on ${HOME}. The module does not verify that the credential file permissions are safe.
pam_oath normally runs as root and rewrites the usersfile after every successful authentication to prevent OTP replay. Its rewrite process creates .lock and .new files in the same directory before atomically replacing the original file.
Configure usersfile to use a root-owned, protected file such as the documented /etc/users.oath location. The documentation specifically recommends chmod go-rw /etc/users.oath to prevent unauthorized reads and writes.
Review the pam_oath usersfile setting and check whether it resolves to a file controlled by root rather than by an unprivileged user. Also verify that unauthorized users cannot read or modify the credential file; pam_oath will not perform this validation itself.