pam_usb 0.9.2 Security Update: Fixes XXE, FD Leak, TOCTOU, and 11 Other Vulnerabilities

Vulnerability Overview This page contains the release notes for version 0.9.2 of the project, with a focus on security hardening. This update resolves 12 security issues, including one bug fix, one reliability improvement, and one enhancement. All changes were made to address specific issues. Impact Scope File Descriptor Leak: In and , was not passed to , causing file descriptors to leak to child processes. Sensitive Data Residue: Heap memory was not cleared in , leaving sensitive data (such as credentials and paths) residual in freed memory. Symlink Attack: was not used in , potentially allowing symlink attacks. Race Conditions: A race condition exists in , and a concurrent update race condition exists in . Environment Injection: Using in the can lead to environment variable injection. XML External Entity (XXE): XXE was not disabled in , potentially allowing XML external entity expansion attacks. Null Pointer Dereference: Handling the null field in may lead to null pointer dereference. Infinite Loop DoS: The absence of cycle detection in can lead to infinite loops. Integer Overflow: Lack of boundary checks in and can lead to undefined behavior. Remediation File Descriptor Leak: Pass to in and . Sensitive Data Residue: Clear heap memory in . Symlink Attack: Use in . Race Conditions: Close the race window between and in , and prevent concurrent updates in . Environment Injection: Use in the . XML External Entity (XXE): Pass explicit parser flags to disable XXE in . Null Pointer Dereference: Handle the null field in . Infinite Loop DoS: Add cycle detection in . Integer Overflow: Add boundary checks in and . Other Fixes and Improvements Configuration Option Application: Fixed an issue where device-level override options (such as and ) were not applied correctly. Environment Variable Truncation: Fixed an issue where environment variable values exceeding in were truncated; dynamic allocation is now used. Log Errors: Now logs a clear error message when superuser device filtering removes all devices. Notes Security Advisories (GHSA) will be published after the release. For more details, please refer to the . Code Block No specific POC code or exploit code is included on this page.

Goal Reached Thanks to every supporter — we hit 100%!

pam_usb 0.9.2 Security Update: Fixes XXE, FD Leak, TOCTOU, and 11 Other Vulnerabilities

More from this source