Improper authentication in pam_pkcs11 - CVE-2025-24032

Vulnerability identifier: #VU106019

CSH Severity: High

CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-24032

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the default cert_policy value is set to "none". A remote attacker can forge a token and bypass authentication process.

pam_pkcs11
Debian Linux
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Basesystem Module
openSUSE Leap
Ubuntu
libpam-pkcs11 (Ubuntu package)
pam_pkcs11-debuginfo-32bit
pam_pkcs11-32bit
pam_pkcs11
pam_pkcs11-debugsource
pam_pkcs11-debuginfo
pam_pkcs11-64bit-debuginfo
pam_pkcs11-64bit
pam_pkcs11-devel-doc
pam_pkcs11-32bit-debuginfo
pam-pkcs11 (Debian package)
SmartFabric Manager

Install updates from vendor's website.

pam_pkcs11 - update to 0.6.13
libpam-pkcs11 (Ubuntu package) - addressed in versions Ubuntu Pro, 0.6.11-2ubuntu0.1, 0.6.11-4ubuntu0.1, 0.6.12-2ubuntu0.24.04.1, 0.6.12-2ubuntu0.24.10.1
pam_pkcs11-debuginfo-32bit - update to 0.6.8-7.8.1
pam_pkcs11-32bit - addressed in versions 0.6.8-7.8.1, 0.6.10-150600.16.3.1
pam_pkcs11 - addressed in versions 0.6.8-7.8.1, 0.6.10-150100.3.6.1, 0.6.10-150600.16.3.1
pam_pkcs11-debugsource - addressed in versions 0.6.8-7.8.1, 0.6.10-150100.3.6.1, 0.6.10-150600.16.3.1
pam_pkcs11-debuginfo - addressed in versions 0.6.8-7.8.1, 0.6.10-150100.3.6.1, 0.6.10-150600.16.3.1
pam_pkcs11-64bit-debuginfo - update to 0.6.10-150600.16.3.1
pam_pkcs11-64bit - update to 0.6.10-150600.16.3.1
pam_pkcs11-devel-doc - update to 0.6.10-150600.16.3.1
pam_pkcs11-32bit-debuginfo - update to 0.6.10-150600.16.3.1
pam-pkcs11 (Debian package) - update to 0.6.12-1+deb12u1
SmartFabric Manager - update to 1.3.0

• https://github.com/OpenSC/pam_pkcs11/commit/470263258d1ac59c5eade439c4d9caba0097e6e6
• https://github.com/OpenSC/pam_pkcs11/commit/b665b287ff955bbbd9539252ff9f9e2754c3fb48
• https://github.com/OpenSC/pam_pkcs11/commit/d9530167966a77115db6e885d459382a2e52ee9e
• https://github.com/OpenSC/pam_pkcs11/releases/tag/pam_pkcs11-0.6.13
• https://github.com/OpenSC/pam_pkcs11/security/advisories/GHSA-8r8p-7mgp-vf56
• https://lists.debian.org/debian-lts-announce/2025/02/msg00021.html

• Multiple vulnerabilities in OpenSC pam_pkcs11
• Debian update for pam-pkcs11
• Ubuntu update for pam-pkcs11
• SUSE update for pam_pkcs11
• SUSE update for pam_pkcs11
• SUSE update for pam_pkcs11
• Dell SmartFabric Manager update for third-party components