CVE-2025-24531
Description
A flaw was found in pam_pkcs11. The pam_sm_authenticate function wrongly returns PAM_IGNORE in some communication errors with a smartcard or PKCS#11 token, such as a smartcard being removed or a hardware failure. In some specific PAM configurations, this return code allows the authentication process to continue without valid credentials, effectively granting unauthorized access to the system.
Statement
To exploit this flaw, an attacker needs to cause a communication failure between the system software and the smartcard hardware. Additionally, this issue is only exploitable if PAM is configured to allow smartcard login without a secondary password requirement. Due to these reasons, this vulnerability has been rated with a moderate severity.
Mitigation
To mitigate this issue, review PAM configurations that include pam_pkcs11. Ensure that the pam_pkcs11.so module is not configured with sufficient or optional in a manner that allows authentication to succeed when pam_pkcs11 returns PAM_IGNORE due to smartcard communication errors. If pam_pkcs11 is not actively used for authentication, consider removing its entry from the relevant PAM configuration files (e.g., /etc/pam.d/system-auth, /etc/pam.d/login). Incorrect modifications to PAM configuration files can lead to system lockout; always back up configuration files before making changes and test thoroughly.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Unexpected State; Alter Execution Logic
This weakness could place the system in a state that could lead unexpected logic to be executed or other unintended behaviors.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
