Insecure Storage of Sensitive Information in linux-pam - CVE-2024-10041

Vulnerability identifier: #VU100997

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-10041

CWE-ID: CWE-922

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores secrets in memory in plain text. A local user can read the memory and obtain passwords in plain text when PAM is used to perform authentication.

linux-pam
IBM Cloud Pak for Watson AIOps
Business Automation Insights
APEX Cloud Platform for Microsoft Azure
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
IBM QRadar Incident Forensics
SUSE Manager Server 4.3
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 15 SP4
Gentoo Linux
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP3
SUSE Manager Retail Branch Server 4.3
SUSE Manager Proxy 4.3
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Basesystem Module
Development Tools Module
Server Applications Module
openSUSE Leap
openEuler
Submariner
IBM Cloud Pak for Security
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Advanced Cluster Security for Kubernetes
OpenShift Logging
App Connect Enterprise Certified Container
pam-debugsource
pam-devel
pam-32bit
pam
pam-extra-debuginfo-32bit
pam-extra-32bit
pam-debuginfo-32bit
pam-extra
pam-extra-debuginfo
pam-debuginfo
pam-doc
sys-libs/pam
pam-32bit-debuginfo
pam-extra-32bit-debuginfo
pam-devel-32bit
pam (Red Hat package)
pam-help
pam-libs
pam_apparmor-debuginfo-32bit
libapparmor1-32bit
pam_apparmor-32bit
apache2-mod_apparmor
libapparmor1-debuginfo-32bit
pam_apparmor-debuginfo
apparmor-profiles
apparmor-utils
apparmor-docs
libapparmor-devel
apache2-mod_apparmor-debuginfo
pam_apparmor
apparmor-parser-debuginfo
perl-apparmor-debuginfo
libapparmor1-debuginfo
perl-apparmor
libapparmor1
apparmor-parser
apparmor-debugsource
python3-apparmor
ruby-apparmor-debuginfo
python3-apparmor-debuginfo
libapparmor-debugsource
ruby-apparmor
libapparmor1-64bit-debuginfo
libapparmor1-64bit
pam_apparmor-64bit-debuginfo
pam_apparmor-64bit
libapparmor1-32bit-debuginfo
pam_apparmor-32bit-debuginfo
apparmor-utils-lang
apparmor-parser-lang
apparmor-abstractions
Multicluster Engine for Kubernetes
OpenShift Service Mesh
Red Hat OpenShift Container Platform
IBM Qradar SIEM

Install updates from vendor's website.

linux-pam - update to 1.7.0
Submariner - update to 0.16.8
IBM Cloud Pak for Watson AIOps - update to 4.10.0
Business Automation Insights - addressed in versions 24.0.0.0.4, 24.0.1.0.4
pam-debugsource - addressed in versions 1.1.8-24.64.1, 1.1.8-24.77.1, 1.3.0-150000.6.76.1, 1.3.0-150000.6.86.1
pam-devel - addressed in versions 1.1.8-24.64.1, 1.1.8-24.77.1, 1.3.0-150000.6.76.1, 1.3.0-150000.6.86.1
pam-32bit - addressed in versions 1.1.8-24.64.1, 1.1.8-24.77.1, 1.3.0-150000.6.76.1, 1.3.0-150000.6.86.1
pam - addressed in versions 1.1.8-24.64.1, 1.1.8-24.77.1, 1.3.0-150000.6.76.1, 1.3.0-150000.6.86.1
pam-extra-debuginfo-32bit - addressed in versions 1.1.8-24.64.1, 1.1.8-24.77.1
pam-extra-32bit - addressed in versions 1.1.8-24.64.1, 1.1.8-24.77.1, 1.3.0-150000.6.76.1, 1.3.0-150000.6.86.1
pam-debuginfo-32bit - addressed in versions 1.1.8-24.64.1, 1.1.8-24.77.1
pam-extra - addressed in versions 1.1.8-24.64.1, 1.1.8-24.77.1, 1.3.0-150000.6.76.1, 1.3.0-150000.6.86.1
pam-extra-debuginfo - addressed in versions 1.1.8-24.64.1, 1.1.8-24.77.1, 1.3.0-150000.6.76.1, 1.3.0-150000.6.86.1
pam-debuginfo - addressed in versions 1.1.8-24.64.1, 1.1.8-24.77.1, 1.3.0-150000.6.76.1, 1.3.0-150000.6.86.1
pam-doc - addressed in versions 1.1.8-24.64.1, 1.1.8-24.77.1, 1.3.0-150000.6.76.1, 1.3.0-150000.6.86.1
sys-libs/pam - update to 1.2.1
pam-32bit-debuginfo - addressed in versions 1.3.0-150000.6.76.1, 1.3.0-150000.6.86.1
pam-extra-32bit-debuginfo - addressed in versions 1.3.0-150000.6.76.1, 1.3.0-150000.6.86.1
pam-devel-32bit - addressed in versions 1.3.0-150000.6.76.1, 1.3.0-150000.6.86.1
pam - addressed in versions 1.3.1-36, 1.5.3-2
pam-devel - addressed in versions 1.3.1-36, 1.5.3-2
pam (Red Hat package) - addressed in versions 1.3.1-36.el8_10, 1.5.1-21.el9_4, 1.5.1-21.el9_5
pam-help - addressed in versions 1.4.0-15, 1.5.2-12, 1.5.3-8
pam-devel - addressed in versions 1.4.0-15, 1.5.2-12, 1.5.3-8
pam-debugsource - addressed in versions 1.4.0-15, 1.5.2-12, 1.5.3-8
pam-debuginfo - addressed in versions 1.4.0-15, 1.5.2-12, 1.5.3-8
pam - addressed in versions 1.4.0-15, 1.5.2-12, 1.5.3-8
APEX Cloud Platform for Microsoft Azure - update to 01.05.01.00
pam-libs - update to 1.5.3-2
pam-doc - update to 1.5.3-2
IBM Cloud Pak for Security - update to 1.11.2.0
Multicluster Engine for Kubernetes - addressed in versions 2.4.7, 2.7.2
OpenShift Service Mesh - addressed in versions 2.4.13, 2.5.7, 2.6.5
pam_apparmor-debuginfo-32bit - update to 2.8.2-56.26.1
libapparmor1-32bit - addressed in versions 2.8.2-56.26.1, 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
pam_apparmor-32bit - addressed in versions 2.8.2-56.26.1, 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
apache2-mod_apparmor - addressed in versions 2.8.2-56.26.1, 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
libapparmor1-debuginfo-32bit - update to 2.8.2-56.26.1
pam_apparmor-debuginfo - addressed in versions 2.8.2-56.26.1, 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
apparmor-profiles - addressed in versions 2.8.2-56.26.1, 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
apparmor-utils - addressed in versions 2.8.2-56.26.1, 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
apparmor-docs - addressed in versions 2.8.2-56.26.1, 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
libapparmor-devel - addressed in versions 2.8.2-56.26.1, 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
apache2-mod_apparmor-debuginfo - addressed in versions 2.8.2-56.26.1, 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
pam_apparmor - addressed in versions 2.8.2-56.26.1, 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
apparmor-parser-debuginfo - addressed in versions 2.8.2-56.26.1, 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
perl-apparmor-debuginfo - addressed in versions 2.8.2-56.26.1, 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
libapparmor1-debuginfo - addressed in versions 2.8.2-56.26.1, 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
perl-apparmor - addressed in versions 2.8.2-56.26.1, 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
libapparmor1 - addressed in versions 2.8.2-56.26.1, 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
apparmor-parser - addressed in versions 2.8.2-56.26.1, 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
apparmor-debugsource - addressed in versions 2.8.2-56.26.1, 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
Red Hat Advanced Cluster Management for Kubernetes - update to 2.9.6
python3-apparmor - addressed in versions 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
ruby-apparmor-debuginfo - addressed in versions 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
python3-apparmor-debuginfo - addressed in versions 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
libapparmor-debugsource - addressed in versions 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
ruby-apparmor - addressed in versions 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
libapparmor1-64bit-debuginfo - addressed in versions 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
libapparmor1-64bit - addressed in versions 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
pam_apparmor-64bit-debuginfo - addressed in versions 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
pam_apparmor-64bit - addressed in versions 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
libapparmor1-32bit-debuginfo - addressed in versions 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
pam_apparmor-32bit-debuginfo - addressed in versions 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
apparmor-utils-lang - addressed in versions 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
apparmor-parser-lang - addressed in versions 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
apparmor-abstractions - addressed in versions 2.13.6-150300.3.24.1, 3.0.4-150400.5.18.1, 3.0.4-150500.11.18.1, 3.1.7-150600.5.9.1
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 4.4.8, 4.6.0
DB2 Warehouse on Cloud Pak for Data - update to 4.8.8
DB2 on Cloud Pak for Data - update to 4.8.8
Red Hat OpenShift Container Platform - addressed in versions 4.14.42, 4.16.24
OpenShift Logging - update to 5.6.27
IBM QRadar Incident Forensics - update to 7.5.0 UP10 IF02
IBM Qradar SIEM - update to 7.5.0 Update Pack 10 IF02
App Connect Enterprise Certified Container - update to 12.8.0

• https://access.redhat.com/security/cve/CVE-2024-10041
• https://bugzilla.redhat.com/show_bug.cgi?id=2319212

• Multiple vulnerabilities in linux-pam
• Red Hat Enterprise Linux 9 update for pam
• Red Hat Enterprise Linux 8 update for pam
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.6
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.7
• Multiple vulnerabilities in OpenShift Service Mesh 2.4
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Multiple vulnerabilities in IBM QRadar SIEM
• Red Hat Enterprise Linux 9 update for pam
• Multiple vulnerabilities in OpenShift Logging 5.6
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.4
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.9
• Multiple vulnerabilities in Submariner
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in OpenShift Service Mesh 2.6
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.4
• Anolis OS update for pam
• SUSE update for pam
• SUSE update for pam
• Multiple vulnerabilities in IBM Cloud Pak for Security
• SUSE update for apparmor
• SUSE update for apparmor
• SUSE update for apparmor
• SUSE update for apparmor
• Gentoo update for PAM
• SUSE update for apparmor
• SUSE update for apparmor
• Anolis OS update for pam
• openEuler 24.03 LTS update for pam
• openEuler 22.03 LTS SP4 update for pam
• openEuler 22.03 LTS SP3 update for pam
• openEuler 20.03 LTS SP4 update for pam
• Dell APEX Cloud Platform for Microsoft Azure update for third-party components
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM Business Automation Insights
• SUSE update for pam
• SUSE update for pam
• SUSE update for pam