CVE-2020-27780 Auth bypass in pam

Critical 9.8 Published 17 Dec 2020 Updated 4 Aug 2024

Attackers can authenticate as root with an empty password for non-existing users, leading to privilege escalation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-27780?

CVE-2020-27780 is a critical authentication bypass vulnerability in pam, published on 17 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate.

Weakness: CWE-287

Which versions are affected by CVE-2020-27780?

It affects 1 product.

Products include Linux-Pam Linux-Pam.

How do I fix CVE-2020-27780?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-27780 being exploited?

There is no known exploitation of CVE-2020-27780 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2020-27780, CLEANSTART-2024-EB52212, GHSA-pgjg-jx8c-q35f.