EUVD-2026-37934Severity by source
AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
Root write access to config mandates PR:H and AV:L; AC:H for multi-step prerequisite; S:C because pam_usb.so executes inside setuid sudo/su processes.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
Lifecycle Timeline
4DescriptionCVE.org
pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, pam_usb calls xmlReadFile() with flags=0 when loading the configuration file, allowing libxml2 to process external entity references (XXE), potentially making outbound network connections or local file reads at XML parse time from the context of the authenticating process. The vulnerability requires the configuration file to contain crafted XML entity references. Since pam_usb.conf is root-owned, direct exploitation requires prior write access to the config, but the defence-in-depth impact is significant given that pam_usb.so runs in setuid contexts (sudo, su). This issue has been fixed in version 0.9.2.
AnalysisAI
XXE injection in pam_usb prior to 0.9.2 enables an attacker with write access to the root-owned configuration file to trigger unauthorized outbound network connections or local file reads during XML parsing, executing within privileged setuid contexts (sudo, su). The vulnerability stems from libxml2's xmlReadFile() being called with flags=0, leaving external entity processing enabled by default - a configuration-time oversight rather than a runtime input flaw. No public exploit identified at time of analysis, but the scope change (S:C in CVSS) reflects that exploitation occurs inside processes running with elevated privileges, amplifying the potential impact of any upstream compromise that enables config tampering.
Technical ContextAI
pam_usb (CPE: cpe:2.3:a:mcdope:pam_usb:*:*:*:*:*:*:*:*) is a Linux PAM module that authenticates users against removable USB devices, parsing its configuration via libxml2's xmlReadFile(). CWE-611 (Improper Restriction of XML External Entity Reference) is the root cause: by passing flags=0, the caller implicitly enables libxml2's default behavior of resolving external entity declarations embedded in XML, including file:// and network-based URIs. Since pam_usb.so is loaded by setuid binaries such as sudo and su, any XML parsing side-effects - outbound HTTP/DNS requests, local file reads - occur in the security context of those privileged processes. The fix (PR #385 in the 0.9.2 release) passes explicit parser flags to xmlReadFile() to disable XXE resolution, consistent with the defense-in-depth hardening theme of the 0.9.2 release, which addressed 12 separate security findings.
RemediationAI
Upgrade to pam_usb 0.9.2, which resolves the XXE issue by passing explicit libxml2 parser flags to disable external entity expansion in xmlReadFile() (PR #385). The release is available at https://github.com/mcdope/pam_usb/releases/tag/0.9.2. As a compensating control prior to patching, restrict write permissions on pam_usb.conf to the absolute minimum (root:root, mode 0600) and audit for unexpected modifications using file integrity monitoring - note that this does not eliminate the vulnerability but removes any non-root path to config tampering. Additionally, consider temporarily removing pam_usb from the PAM stack for high-risk services (sudo, su) until patching is complete; the trade-off is loss of hardware authentication for those services during the interim period.
Authentication bypass in pam_usb before 0.9.1 allows remote unauthenticated attackers to reach the USB hardware-authenti
Authentication bypass in pam_usb prior to 0.9.0 lets a local user defeat the USB hardware-authentication factor by delet
Heap buffer overflow in pam_usb prior to 0.9.1 allows a local attacker with high privileges to corrupt heap memory on 32
XPath injection in pam_usb prior to 0.9.0 allows unauthenticated remote attackers to manipulate device-verification quer
PATH hijacking in pam_usb helper tools prior to version 0.9.0 allows a local low-privileged attacker who can manipulate
Environment variable injection in pam_usb prior to version 0.9.2 allows a local authenticated user to bypass hardware US
Symlink race condition in pam_usb prior to 0.9.2 allows a local attacker to redirect one-time pad files to an attacker-c
Non-atomic one-time pad file creation in pam_usb prior to 0.9.2 exposes the core replay-prevention mechanism to a local
Concurrent PAM invocations in pam_usb prior to 0.9.1 expose a process-wide static pointer race condition in src/log.c, w
NULL pointer dereference in pam_usb 0.9.1 and below crashes PAM-integrated authentication services (sudo, login) when lo
Infinite loop denial-of-service in pam_usb 0.9.1 and earlier can permanently hang authentication processes such as sudo,
Insecure deallocation in pam_usb 0.9.1 and below leaves sensitive authentication material - including one-time pad (OTP)
Share
External POC / Exploit Code
Leaving vuln.today