EUVD-2026-37923Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Local-only race condition with timing dependency justifies AV:L and AC:H; existing unprivileged shell required (PR:L); impact is purely availability of the auth process (A:H, C:N, I:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
pam_usb provides hardware authentication for Linux using removable media. In pam_usb 0.9.1 and earlier, usb_get_process_parent_id() can cause an infinite loop DoS because it does not initialize *ppid on failure. In pusb_local_login(), the same variable is reused as input and output in a process-tree while loop; if /proc/<pid>/stat cannot be read (for example, when an ancestor process exits during authentication), the PID is not updated and the loop does not terminate. This hangs the authenticating process (such as sudo, sshd, or login) until it is forcibly terminated. This issue has been fixed in version 0.9.2.
AnalysisAI
Infinite loop denial-of-service in pam_usb 0.9.1 and earlier can permanently hang authentication processes such as sudo, sshd, or login on Linux systems using USB hardware authentication. The flaw is in usb_get_process_parent_id(), which fails to initialize *ppid on failure; pusb_local_login() reuses the same variable as both input and output in a process-tree traversal loop, so if /proc/<pid>/stat becomes unreadable mid-authentication (e.g., an ancestor process exits during the auth window), the PID is never advanced and the loop never terminates. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated local attacker with at minimum low-privilege shell access (PR:L per CVSS) on a Linux system where pam_usb 0.9.1 or earlier is active in the PAM stack for at least one service (sudo, sshd, or login). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately captures the threat profile: local access only, high attack complexity due to the race condition, low-privilege attacker, and impact strictly limited to availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged local attacker obtains a shell on a system running pam_usb 0.9.1 and initiates repeated sudo invocations, timing the exit of an intermediate ancestor process (such as a shell or terminal multiplexer session) to coincide with pam_usb's /proc traversal during the authentication phase. If /proc/<pid>/stat of the exiting ancestor becomes unreadable mid-walk, usb_get_process_parent_id() returns without updating *ppid, and pusb_local_login()'s loop spins on the same stale PID indefinitely. … |
| Remediation | Vendor-released patch: 0.9.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in pam_usb before 0.9.1 allows remote unauthenticated attackers to reach the USB hardware-authenti
Authentication bypass in pam_usb prior to 0.9.0 lets a local user defeat the USB hardware-authentication factor by delet
Heap buffer overflow in pam_usb prior to 0.9.1 allows a local attacker with high privileges to corrupt heap memory on 32
XXE injection in pam_usb prior to 0.9.2 enables an attacker with write access to the root-owned configuration file to tr
XPath injection in pam_usb prior to 0.9.0 allows unauthenticated remote attackers to manipulate device-verification quer
PATH hijacking in pam_usb helper tools prior to version 0.9.0 allows a local low-privileged attacker who can manipulate
Environment variable injection in pam_usb prior to version 0.9.2 allows a local authenticated user to bypass hardware US
Symlink race condition in pam_usb prior to 0.9.2 allows a local attacker to redirect one-time pad files to an attacker-c
Non-atomic one-time pad file creation in pam_usb prior to 0.9.2 exposes the core replay-prevention mechanism to a local
Concurrent PAM invocations in pam_usb prior to 0.9.1 expose a process-wide static pointer race condition in src/log.c, w
NULL pointer dereference in pam_usb 0.9.1 and below crashes PAM-integrated authentication services (sudo, login) when lo
Insecure deallocation in pam_usb 0.9.1 and below leaves sensitive authentication material - including one-time pad (OTP)
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today