https://seclists.org/oss-sec/2025/q1/116: pam_pkcs11: Possible Authentication Bypass in Error Situations (CVE-2025-24531)
Published Feb 7, 2025
·Updated
Affected Software
1 affected component
PAM pam_pkcs11
Frequently Asked Questions
1
What is the severity of CVE-2025-24531?
CVE-2025-24531 is considered a medium severity vulnerability due to its potential for authentication bypass under specific error conditions.
2
How do I fix CVE-2025-24531?
To fix CVE-2025-24531, update to the latest version of the pam_pkcs11 module that resolves the handling of PAM_SUCCESS and PAM_IGNORE.
3
What systems are affected by CVE-2025-24531?
CVE-2025-24531 affects systems utilizing the pam_pkcs11 module as part of their Pluggable Authentication Module (PAM) configuration.
4
What are the potential consequences of CVE-2025-24531?
The potential consequences of CVE-2025-24531 include unauthorized access and authentication bypass in scenarios where error handling is improperly managed.
5
Is there a workaround for CVE-2025-24531 until a patch is available?
A possible workaround for CVE-2025-24531 is to modify the PAM configuration to ensure proper return values from authentication-related modules.