{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pam_usb--0.9.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pam_usb_project:pam_usb:*:*:*:*:*:linux:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-64668"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pam_usb (\u003c 0.9.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA logical flaw exists in the 'deny_remote' feature of pam_usb versions 0.8.0 to 0.9.2. The module checks for active remote tmux sessions by executing \u003ccode\u003e/usr/bin/w -i\u003c/code\u003e. On multi-homed Linux systems, this command appends a zone index to link-local IPv6 addresses (e.g., \u003ccode\u003efe80::1%eth0\u003c/code\u003e). The regex used in \u003ccode\u003epusb_tmux_has_remote_clients()\u003c/code\u003e expects whitespace immediately after the IP address and fails to account for the suffix. Consequently, the function erroneously concludes no remote clients are active, bypassing intended access restrictions. This is patched in version 0.9.3.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized authentication on systems configured to use pam_usb with the 'deny_remote' feature enabled, specifically when the environment utilizes multi-homed network interfaces and IPv6 link-local addresses.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the pam_usb authentication module to version 0.9.3 or later on all affected Linux systems.\u003c/li\u003e\n\u003cli\u003eAudit PAM configurations to determine if \u003ccode\u003edeny_remote\u003c/code\u003e is active for pam_usb.\u003c/li\u003e\n\u003cli\u003eInventory Linux systems utilizing pam_usb for hardware-based authentication.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T13:58:08Z","date_published":"2026-11-11T13:58:08Z","id":"https://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64668/","summary":"The pam_usb authentication module version 0.8.0 through 0.9.2 fails to correctly parse link-local IPv6 addresses with zone indices, leading to an authentication bypass in the deny_remote feature.","title":"pam_usb: Authentication bypass in deny_remote feature (CVE-2026-64668)","url":"https://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64668/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-64666"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pam_usb (\u003c 0.9.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eIn versions prior to 0.9.3, pam_usb uses getenv(3) to retrieve the XRDP_SESSION variable in src/local.c. When pam_usb.so loads into a setuid PAM host, a user can control the environment, allowing them to clear the XRDP_SESSION variable and defeat the module's explicit XRDP-deny rule. Other remote-detection signals such as rmsvc, evdev, loginctl, and utmp may still catch the session. This issue has been patched in version 0.9.3.\u003c/p\u003e\n","date_modified":"2026-11-11T13:58:01Z","date_published":"2026-11-11T13:58:01Z","id":"https://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64666/","summary":"The pam_usb module (prior to 0.9.3) incorrectly uses getenv() instead of secure_getenv() when checking the XRDP_SESSION variable in setuid contexts, enabling attackers to bypass XRDP-related authentication denials.","title":"pam_usb: Authentication bypass via insecure environment variable handling (CVE-2026-64666)","url":"https://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64666/"}],"language":"en","title":"CraftedSignal Threat Feed - Pam_usb (\u003c 0.9.3)","version":"https://jsonfeed.org/version/1.1"}