CVE-2026-47271— pam_usb 代码问题漏洞

pam_usb: OOM guards removed by -DNDEBUG cause NULL dereference and authentication process crash

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, src/mem.c implemented out-of-memory guards for xmalloc(), xrealloc(), and xstrdup() using assert(data != NULL). The C standard specifies that all assert() expressions are compiled out when NDEBUG is defined at build time. NDEBUG is commonly defined in release and packaging builds (Debian, Fedora, Arch package flags all define it via -DNDEBUG in CFLAGS). With the guard removed, xmalloc/xrealloc/xstrdup silently return NULL on allocation failure. Every caller in the codebase dereferences the return value without a NULL check -- this is the intended design, as the guard was supposed to abort before the dereference. With the guard gone, any allocation failure causes a NULL pointer dereference, crashing the PAM module. A crash in a PAM module loaded by sudo or login causes authentication to fail for the duration of the crash, creating a local denial-of-service condition. An attacker who can induce memory pressure at authentication time can lock all users out of sudo and login. This vulnerability is fixed in 0.9.0.

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

空指针解引用

pam_usb 代码问题漏洞

pam_usb是McDope个人开发者的一个基于USB设备的Linux硬件认证工具。 pam_usb 0.9.0之前版本存在代码问题漏洞，该漏洞源于内存分配失败时断言被编译移除导致空指针解引用，可能导致本地拒绝服务。

N/A

N/A