A vulnerability (CVE-2024-47191) has been identified in the PAM module pam_oath, which is part of the oath-toolkit package and used for two-factor authentication with one-time passwords (OTP). This vulnerability allows an unprivileged user to gain root access to the system.
The pam_oath module runs with root privileges and was initially designed to store OATH keys in the file /etc/users.oath, which only the root user can access. In version 2.6.7 of oath-toolkit, support for storing key files in users' home directories (~/config/users.oath) was added. Unprivileged users were given the ability to modify files containing their keys, but pam_oath did not drop privileges when accessing these files and continued to use unsafe methods for file operations that assumed the files were stored in directories that were not modifiable.
The vulnerability arises because after each successful authentication with a one-time password, pam_oath rewrote the key file to prevent the reuse of the same password. The rewrite operation involved creating a lock file in the same directory, writing new content to a file with the extension '.new', and replacing the old file with the new one. However, the file with the '.new' extension was created with the same permissions as the target file, but the write operation was performed by a process with root privileges and without checking for the existence of the file.
If the file was located in a system directory, there were no issues. However, after support for storing key files in home directories was added, an easily exploitable vulnerability emerged. To launch an attack, it is sufficient to create a symbolic link '~/.config/oath.secrets.new' and point it to any system file that will be overwritten after a successful authentication.
To gain root access, one can point the symbolic link to the file /etc/shadow. In this case, pam_oath will write the current list of keys to /etc/shadow and synchronize the owner and access rights with the users.oath file. Since the users.oath file belongs to the user, /etc/shadow will then be owned by this user, after which the attacker can edit the /etc/shadow file and write new login parameters for the root account.
The vulnerability manifests starting from the release of oath-toolkit 2.6.7 and was fixed (1,2,3) in version 2.6.12. Details on the vulnerability fix can be tracked in the distributions on the following pages: Debian, Ubuntu, RHEL, SUSE/openSUSE, Fedora, Arch. The vulnerability affects only configurations where the hosting of files with keys in home directories is allowed, for example, when using the PAM settings line "auth [user_unknown=ignore success=ok] pam_oath.so usersfile=${HOME}/user.oath".
Additionally, a recently identified vulnerability (CVE-2024-9313) in the PAM module from the Authd package, developed by the Ubuntu project, can be mentioned. This vulnerability allows a user managed through the Authd broker to impersonate any other user controlled by the same broker and successfully authenticate via su, sudo, or ssh as another user. The issue has been resolved in Authd version 0.3.5.
Source: opennet.ru
