EUVD-2026-37936Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Local-only TOCTOU race (AV:L, AC:H); low-privilege account sufficient (PR:L); OTP pad exposure yields high confidentiality impact with limited integrity and availability disruption.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Lifecycle Timeline
4DescriptionCVE.org
pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, a symlink race condition exists in per-device and per-user pad directory creation. pam_usb uses a check-then-act pattern: it calls lstat() to test for existence and then calls mkdir() separately to create the directory. A local attacker can win the race between these calls by replacing the target path with a symlink to a directory they control. If successful, one-time pad files may be written to an attacker-controlled location, potentially exposing future pad values before use or disrupting authentication. This issue has been fixed in version 0.9.2.
AnalysisAI
Symlink race condition in pam_usb prior to 0.9.2 allows a local attacker to redirect one-time pad files to an attacker-controlled directory, potentially exposing future OTP values before use and undermining hardware-based PAM authentication on Linux. The flaw is a classic TOCTOU pattern in per-device and per-user pad directory creation, fixed as part of a 12-issue security hardening release (0.9.2) triggered by an ongoing audit. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, successful exploitation could permit authentication bypass by a local low-privilege user.
Technical ContextAI
pam_usb is a Linux PAM module (cpe:2.3:a:mcdope:pam_usb:*:*:*:*:*:*:*:*) that provides hardware-backed authentication using removable USB media combined with one-time pads (OTP). The vulnerable code path implements a non-atomic check-then-act pattern: lstat() is called to test whether a pad directory exists, and mkdir() is called separately to create it if absent. CWE-367 (Time-of-check Time-of-use Race Condition) precisely describes this root cause - the two syscalls are not atomic, leaving a window during which a local attacker can insert a symlink at the target path pointing to an attacker-writable directory. The upstream fix (PR #381 in the 0.9.2 release) closes this race window in pad directory creation; PR #380 adds O_EXCL to pad temp file creation to eliminate a related concurrent-write race on the files themselves. The 0.9.2 release also added O_NOFOLLOW on evdev device opens (a parallel symlink defense) and a range of other hardening measures, indicating the TOCTOU class was a systemic concern in this codebase.
RemediationAI
Upgrade pam_usb to version 0.9.2, confirmed available at https://github.com/mcdope/pam_usb/releases/tag/0.9.2. This release is explicitly a Security Hardening Release addressing 12 distinct security findings, including the TOCTOU race in pad directory creation (PR #381) and the related O_EXCL gap in pad temp file creation (PR #380); the upgrade is strongly recommended by the maintainer and addresses issues beyond this CVE alone. If immediate upgrade is not feasible, restrict local user access so that only trusted accounts can execute code in the PAM authentication context - this eliminates the untrusted-local-actor prerequisite. Alternatively, disabling OTP pad functionality within pam_usb (if the deployment supports operating without OTP) removes the vulnerable code path entirely, though this degrades the authentication assurance the module provides. Filesystem-level controls such as sticky bits or restricted permissions on parent directories containing pad paths can raise the bar for symlink placement but do not eliminate the race window. Note that version 0.9.2 also patches XXE expansion, environment variable injection in PAM context, NULL dereference, integer overflow, and infinite-loop DoS issues - deferring the upgrade carries compounding risk.
Authentication bypass in pam_usb before 0.9.1 allows remote unauthenticated attackers to reach the USB hardware-authenti
Authentication bypass in pam_usb prior to 0.9.0 lets a local user defeat the USB hardware-authentication factor by delet
Heap buffer overflow in pam_usb prior to 0.9.1 allows a local attacker with high privileges to corrupt heap memory on 32
XXE injection in pam_usb prior to 0.9.2 enables an attacker with write access to the root-owned configuration file to tr
XPath injection in pam_usb prior to 0.9.0 allows unauthenticated remote attackers to manipulate device-verification quer
PATH hijacking in pam_usb helper tools prior to version 0.9.0 allows a local low-privileged attacker who can manipulate
Environment variable injection in pam_usb prior to version 0.9.2 allows a local authenticated user to bypass hardware US
Non-atomic one-time pad file creation in pam_usb prior to 0.9.2 exposes the core replay-prevention mechanism to a local
Concurrent PAM invocations in pam_usb prior to 0.9.1 expose a process-wide static pointer race condition in src/log.c, w
NULL pointer dereference in pam_usb 0.9.1 and below crashes PAM-integrated authentication services (sudo, login) when lo
Infinite loop denial-of-service in pam_usb 0.9.1 and earlier can permanently hang authentication processes such as sudo,
Insecure deallocation in pam_usb 0.9.1 and below leaves sensitive authentication material - including one-time pad (OTP)
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today