Resource exhaustion in linux-pam - CVE-2024-22365

Vulnerability identifier: #VU85552

CSH Severity: Low

CVSS v4 BT: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-22365

CWE-ID: CWE-400

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in pam_namespace. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

linux-pam
PowerStore X
PowerStore T
Storage Resource Manager
Amazon Linux AMI
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Software Development Kit 12
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Ubuntu
Slackware Linux
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
Basesystem Module
Development Tools Module
openSUSE Leap
openEuler
Voice Gateway
IBM MQ Operator
Migration Toolkit for Runtimes
Ansible Automation Platform
Red Hat Advanced Cluster Management for Kubernetes
Red Hat OpenShift distributed tracing (RHOSDT)
IBM Cloud Transformation Advisor
Red Hat OpenShift Dev Spaces
App Connect Enterprise Certified Container
Red Hat Migration Toolkit for Applications
LANTIME Operating System Firmware (LTOS)
Juniper Secure Analytics (JSA)
IBM Qradar SIEM
libpam-modules (Ubuntu package)
pam-extra-debuginfo-32bit
pam-devel
pam-debuginfo
pam-debugsource
pam
pam-extra-debuginfo
pam-extra
pam-doc
pam-extra-32bit
pam-debuginfo-32bit
pam-32bit
pam-devel-32bit
pam-extra-32bit-debuginfo
pam-32bit-debuginfo
pam (Red Hat package)
pam-help
pam-libs
OpenShift API for Data Protection (OADP)
Red Hat OpenShift GitOps
OpenShift Service Mesh
OpenShift Virtualization
Dell EMC Storage Monitoring and Reporting (SMR)
Red Hat OpenShift Container Platform
IBM DataPower Gateway
Red Hat Ceph Storage
Red Hat Single Sign-On
IBM CICS TX Advanced

Install updates from vendor's website.

linux-pam - update to 1.6.0
Voice Gateway - update to 1.0.8.12
IBM MQ Operator - addressed in versions 2.0.23, 3.2.0
LANTIME Operating System Firmware (LTOS) - update to 7.08.010
Juniper Secure Analytics (JSA) - update to 7.5.0 UP9 IF02
IBM Qradar SIEM - update to 7.5.0 Update Pack 9 IF02
libpam-modules (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1.3.1-5ubuntu4.7, 1.4.0-11ubuntu2.4, 1.5.2-5ubuntu1.1, 1.5.2-6ubuntu1.1
pam-extra-debuginfo-32bit - update to 1.1.8-24.56.1
pam-devel - addressed in versions 1.1.8-24.56.1, 1.3.0-150000.6.66.1
pam-debuginfo - addressed in versions 1.1.8-24.56.1, 1.3.0-150000.6.66.1
pam-debugsource - addressed in versions 1.1.8-24.56.1, 1.3.0-150000.6.66.1
pam - addressed in versions 1.1.8-24.56.1, 1.3.0-150000.6.66.1
pam-extra-debuginfo - addressed in versions 1.1.8-24.56.1, 1.3.0-150000.6.66.1
pam-extra - addressed in versions 1.1.8-24.56.1, 1.3.0-150000.6.66.1
pam-doc - addressed in versions 1.1.8-24.56.1, 1.3.0-150000.6.66.1
pam-extra-32bit - addressed in versions 1.1.8-24.56.1, 1.3.0-150000.6.66.1
pam-debuginfo-32bit - update to 1.1.8-24.56.1
pam-32bit - addressed in versions 1.1.8-24.56.1, 1.3.0-150000.6.66.1
Migration Toolkit for Runtimes - update to 1.2.6
pam-devel-32bit - update to 1.3.0-150000.6.66.1
pam-extra-32bit-debuginfo - update to 1.3.0-150000.6.66.1
pam-32bit-debuginfo - update to 1.3.0-150000.6.66.1
pam - addressed in versions 1.3.1-28, 1.5.3-3
pam-devel - addressed in versions 1.3.1-28, 1.5.3-3
pam (Red Hat package) - addressed in versions 1.3.1-33.el8, 1.5.1-19.el9
OpenShift API for Data Protection (OADP) - update to 1.3.2
pam-help - addressed in versions 1.4.0-10, 1.4.0-11, 1.5.2-7
pam-debuginfo - addressed in versions 1.4.0-10, 1.4.0-11, 1.5.2-7
pam-devel - addressed in versions 1.4.0-10, 1.4.0-11, 1.5.2-7
pam-debugsource - addressed in versions 1.4.0-10, 1.4.0-11, 1.5.2-7
pam - addressed in versions 1.4.0-10, 1.4.0-11, 1.5.2-7
pam - update to 1.5.1-8
pam-doc - update to 1.5.3-3
pam-libs - update to 1.5.3-3
pam - update to 1.6.0
Red Hat OpenShift GitOps - addressed in versions 1.10.6, 1.11.5, 1.12.3
Ansible Automation Platform - update to 2.4
OpenShift Service Mesh - addressed in versions 2.4.8, 2.5.2
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.10.5, 2.12.0
Red Hat OpenShift distributed tracing (RHOSDT) - update to 3.2.0
PowerStore X - update to 3.2.1.4-2386214
IBM Cloud Transformation Advisor - update to 3.10.0
Red Hat OpenShift Dev Spaces - update to 3.16.0
PowerStore T - update to 4.0.0.2-2365061
Storage Resource Manager - update to 4.10.0.3
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.10.0.3
OpenShift Virtualization - update to 4.14.6
Red Hat OpenShift Container Platform - addressed in versions 4.16.15, 4.17.0
App Connect Enterprise Certified Container - addressed in versions 5.0.19, 12.2.0
Red Hat Ceph Storage - update to 5.3
Red Hat Migration Toolkit for Applications - addressed in versions 6.2.3, 7.0.3
Red Hat Single Sign-On - update to 7.6.9
IBM CICS TX Advanced - update to 10.1.0.0 ifix29
IBM DataPower Gateway - addressed in versions 10.5.0.14, 10.6.0.2

• https://github.com/linux-pam/linux-pam/releases/tag/v1.6.0

• Local denial of service in Linux-PAM
• Ubuntu update for pam
• SUSE update for pam
• SUSE update for pam
• Slackware Linux update for pam
• openEuler update for pam
• openEuler 22.03 LTS SP3 update for pam
• openEuler 20.03 LTS SP4 update for pam
• Ubuntu update for pam
• Red Hat Enterprise Linux 9 update for pam
• Red Hat Enterprise Linux 8 update for pam
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in Migration Toolkit for Runtimes 1.2
• Multiple vulnerabilities in OpenShift Virtualization 4.14
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.3
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Multiple vulnerabilities in OpenShift Service Mesh 2.4
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications 6.2
• Multiple vulnerabilities in IBM MQ Operator
• Multiple vulnerabilities in Red Hat Ceph Storage 5
• SUSE update for pam
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Amazon Linux AMI update for pam
• Multiple vulnerabilities in App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM CICS TX Advanced
• Multiple vulnerabilities in IBM Qradar SIEM
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.10
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.12
• Multiple vulnerabilities in Dell PowerStore X
• IBM DataPower Gateway update for Linux-pam
• Multiple vulnerabilities in Dell PowerStore T Family
• Anolis OS update for pam
• Meinberg LANTIME firmware update for third-party components (April 2024)
• Multiple vulnerabilities in IBM Voice Gateway
• Anolis OS update for pam
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications 7.0
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.10
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.11
• Multiple vulnerabilities in Red Hat OpenShift distributed tracing (RHOSDT) 3.2