Pam_usb (< 0.9.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pam_usb--0.9.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:58:08 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgpam_usb: Authentication bypass in deny_remote feature (CVE-2026-64668)https://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64668/Wed, 11 Nov 2026 13:58:08 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64668/The pam_usb authentication module version 0.8.0 through 0.9.2 fails to correctly parse link-local IPv6 addresses with zone indices, leading to an authentication bypass in the deny_remote feature.A logical flaw exists in the 'deny_remote' feature of pam_usb versions 0.8.0 to 0.9.2. The module checks for active remote tmux sessions by executing /usr/bin/w -i. On multi-homed Linux systems, this command appends a zone index to link-local IPv6 addresses (e.g., fe80::1%eth0). The regex used in pusb_tmux_has_remote_clients() expects whitespace immediately after the IP address and fails to account for the suffix. Consequently, the function erroneously concludes no remote clients are active, bypassing intended access restrictions. This is patched in version 0.9.3.

Impact

Successful exploitation allows for unauthorized authentication on systems configured to use pam_usb with the 'deny_remote' feature enabled, specifically when the environment utilizes multi-homed network interfaces and IPv6 link-local addresses.

Recommendation

  • Upgrade the pam_usb authentication module to version 0.9.3 or later on all affected Linux systems.
  • Audit PAM configurations to determine if deny_remote is active for pam_usb.
  • Inventory Linux systems utilizing pam_usb for hardware-based authentication.
]]>highadvisorypam_usb: Authentication bypass via insecure environment variable handling (CVE-2026-64666)https://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64666/Wed, 11 Nov 2026 13:58:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-pam-usb-authentication-bypass-cve-2026-64666/The pam_usb module (prior to 0.9.3) incorrectly uses getenv() instead of secure_getenv() when checking the XRDP_SESSION variable in setuid contexts, enabling attackers to bypass XRDP-related authentication denials.<p>In versions prior to 0.9.3, pam_usb uses getenv(3) to retrieve the XRDP_SESSION variable in src/local.c. When pam_usb.so loads into a setuid PAM host, a user can control the environment, allowing them to clear the XRDP_SESSION variable and defeat the module's explicit XRDP-deny rule. Other remote-detection signals such as rmsvc, evdev, loginctl, and utmp may still catch the session. This issue has been patched in version 0.9.3.</p> highadvisory