NULL pointer dereference in pam_pkcs11 - CVE-2025-24031

Vulnerability identifier: #VU106021

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-24031

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in pam_get_pwd. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

pam_pkcs11
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Basesystem Module
openSUSE Leap
Ubuntu
libpam-pkcs11 (Ubuntu package)
pam_pkcs11-debuginfo
pam_pkcs11-debuginfo-32bit
pam_pkcs11-32bit
pam_pkcs11
pam_pkcs11-debugsource
pam_pkcs11-32bit-debuginfo
pam_pkcs11-devel-doc
pam_pkcs11-64bit
pam_pkcs11-64bit-debuginfo
SmartFabric Manager

Install updates from vendor's website.

pam_pkcs11 - update to 0.6.13
libpam-pkcs11 (Ubuntu package) - addressed in versions Ubuntu Pro, 0.6.11-2ubuntu0.1, 0.6.11-4ubuntu0.1, 0.6.12-2ubuntu0.24.04.1, 0.6.12-2ubuntu0.24.10.1
pam_pkcs11-debuginfo - addressed in versions 0.6.8-7.8.1, 0.6.10-150100.3.6.1, 0.6.10-150600.16.3.1
pam_pkcs11-debuginfo-32bit - update to 0.6.8-7.8.1
pam_pkcs11-32bit - addressed in versions 0.6.8-7.8.1, 0.6.10-150600.16.3.1
pam_pkcs11 - addressed in versions 0.6.8-7.8.1, 0.6.10-150100.3.6.1, 0.6.10-150600.16.3.1
pam_pkcs11-debugsource - addressed in versions 0.6.8-7.8.1, 0.6.10-150100.3.6.1, 0.6.10-150600.16.3.1
pam_pkcs11-32bit-debuginfo - update to 0.6.10-150600.16.3.1
pam_pkcs11-devel-doc - update to 0.6.10-150600.16.3.1
pam_pkcs11-64bit - update to 0.6.10-150600.16.3.1
pam_pkcs11-64bit-debuginfo - update to 0.6.10-150600.16.3.1
SmartFabric Manager - update to 1.3.0

• https://github.com/OpenSC/pam_pkcs11/blob/bb2e3f3a95e44fdf44b0d5a4b377db3179021380/src/pam_pkcs11/pam_pkcs11.c#L211
• https://github.com/OpenSC/pam_pkcs11/blob/bb2e3f3a95e44fdf44b0d5a4b377db3179021380/src/pam_pkcs11/pam_pkcs11.c#L797
• https://github.com/OpenSC/pam_pkcs11/security/advisories/GHSA-wvr3-c9x3-9mff

• Multiple vulnerabilities in OpenSC pam_pkcs11
• Ubuntu update for pam-pkcs11
• SUSE update for pam_pkcs11
• SUSE update for pam_pkcs11
• SUSE update for pam_pkcs11
• Dell SmartFabric Manager update for third-party components