Description (CNA)
Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux-PAM / Linux-PAM | affected 0 through 1.7.2 |
CWE
CWE-208
References
- https://github.com/linux-pam/linux-pam
- https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327
- https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h
- https://cwe.mitre.org/data/definitions/208.html
ADP enrichment
No English description supplied.
No references supplied.