CVE-2024-10963 Pam: improper hostname interpretation in pam_access leads to access control bypass
Attackers can bypass access controls in pam_access by spoofing hostnames, gaining unauthorized access to services or terminals on affected Linux systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-10963?
CVE-2024-10963 is a high-severity authentication bypass vulnerability in Red Hat Enterprise Linux 10, published on 7 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.
Weakness: CWE-287
Which versions are affected by CVE-2024-10963?
Linux distribution packages (21)
pam AlmaLinux:9 | All versions | 1.5.1-22.el9_5 |
pam-devel AlmaLinux:9 | All versions | 1.5.1-22.el9_5 |
pam-docs AlmaLinux:9 | All versions | 1.5.1-22.el9_5 |
pam-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.5.1-22.el9_5 |
pam-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:1.5.1-22.el9_5 |
pam-devel Red Hat:enterprise_linux:9::appstream | All versions | 0:1.5.1-22.el9_5 |
pam-docs Red Hat:enterprise_linux:9::appstream | All versions | 0:1.5.1-22.el9_5 |
pam Red Hat:enterprise_linux:9::baseos | All versions | 0:1.5.1-22.el9_5 |
pam-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:1.5.1-22.el9_5 |
pam-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:1.5.1-22.el9_5 |
pam-debuginfo Red Hat:rhel_eus:9.4::appstream | All versions | 0:1.5.1-23.el9_4 |
pam-debugsource Red Hat:rhel_eus:9.4::appstream | All versions | 0:1.5.1-23.el9_4 |
pam-devel Red Hat:rhel_eus:9.4::appstream | All versions | 0:1.5.1-23.el9_4 |
pam-docs Red Hat:rhel_eus:9.4::appstream | All versions | 0:1.5.1-23.el9_4 |
pam Red Hat:rhel_eus:9.4::baseos | All versions | 0:1.5.1-23.el9_4 |
pam-debuginfo Red Hat:rhel_eus:9.4::baseos | All versions | 0:1.5.1-23.el9_4 |
pam-debugsource Red Hat:rhel_eus:9.4::baseos | All versions | 0:1.5.1-23.el9_4 |
pam Rocky Linux:9 | All versions | 0:1.5.1-22.el9_5 |
pam SUSE:Linux Micro 6.0 | All versions | 1.6.0-4.1 |
pam SUSE:Linux Micro 6.1 | All versions | 1.6.1-slfo.1.1_2.1 |
pam openSUSE:Tumbleweed | All versions | 1.7.0-2.1 |
How do I fix CVE-2024-10963?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-10963 being exploited?
There is no known exploitation of CVE-2024-10963 in the wild and no public exploit code.
Sources
Also known as ALSA-2024:10244, AZL-52539, BELL-CVE-2024-10963, CLSA-2024-1733245591, CLSA-2024-1735300164, DEBIAN-CVE-2024-10963 and 10 more.