CVE-2024-22365CWE-664

CVE-2024-22365

Medium · published February 6, 2024

CVSS v3.1
5.5
EPSS
0%
Percentile
38.8
In the wild
Unconfirmed
What it is

linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00459 · 38.8th percentile
Weakness
CWE-664 · Improper Control of a Resource Through its Lifetime
Published
2024-02-06T13:15Z
Affected products (1)
ProductVersionsFixed in
linux-pam/linux-pam< 1.6.01.6.0
References (11)
http://www.openwall.com/lists/oss-security/2024/01/18/3 · [email protected]https://github.com/linux-pam/linux-pam · [email protected]https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb · [email protected]https://github.com/linux-pam/linux-pam/releases/tag/v1.6.0 · [email protected]http://www.openwall.com/lists/oss-security/2024/01/18/3 · af854a3a-2127-422b-91ae-364da2661108https://github.com/linux-pam/linux-pam · af854a3a-2127-422b-91ae-364da2661108https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb · af854a3a-2127-422b-91ae-364da2661108https://github.com/linux-pam/linux-pam/releases/tag/v1.6.0 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2025/09/msg00021.html · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-577017.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-794697.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 06 FEB 00:00Z
    linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for…
    cvelistv5