CVE-2024-10041: Pam: libpam: libpam vulnerable to read hashed password
A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.
Other sources
A vulnerability was found in PAM. The secret is in memory, while the attacker can trigger the victim program to execute by sending characters to its stdin. In-between, they then train the branch predictor to speculatively execute a ROP chain.
Moreover, when stdin is a pipe or file, the FILE IO buffer malloc'd will receive the just-freed IO buffer that was used to read /etc/shadow, so it is also possible to have the secret conveniently available in the uninitialized memory of the stdin's FILE buf.=20
This makes several registers reference the /etc/shadow contents during the read-loop of the fgets call that the polkit agent uses in the pam conversation.=20
The attack is difficult to pull of: - Attacker needs to find a gadget chain in the mapped-in executable memory of the victim - Attacker needs to trigger TLB entries to be prefetched to win the race and fit the transient operations in the misspeculation window. - Attacker needs to tweak the attack to break ASLR. This they also can do using Spectre as well.
— Red Hat
Pam: libpam: libpam vulnerable to read hashed password
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10041?
CVE-2024-10041 is classified as a high severity vulnerability due to the potential for an attacker to exploit it to execute arbitrary code.
How do I fix CVE-2024-10041?
To fix CVE-2024-10041, users should update to the latest version of PAM that addresses this vulnerability.
What does CVE-2024-10041 affect?
CVE-2024-10041 affects Linux PAM implementations, particularly in environments using vulnerable versions of Red Hat Enterprise Linux.
Who can be affected by CVE-2024-10041?
Users and systems running vulnerable versions of Linux PAM on Red Hat Enterprise Linux are at risk of exploitation due to CVE-2024-10041.
Is there a workaround for CVE-2024-10041?
Currently, the recommended approach is to apply updates, as there are no effective workarounds documented for CVE-2024-10041.