linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HLinux Pam
APPLinux-Pam< 1.6.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
DoS
References
Related vulnerabilities
CVE-2022-28321CRITICAL9.8ten sam produkt
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. Th...
CVE-2020-27780CRITICAL9.8ten sam produkt
A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing...
CVE-2010-4708HIGH7.2ten sam produkt
The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home d...
CVE-2024-10041MEDIUM4.7ten sam produkt
A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger t...
CVE-2015-3238MEDIUM6.5ten sam produkt
The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable t...