pam_usb: Heap out-of-bounds read in cmdline scan during authentication
Summary
pam_usb provides hardware authentication on Linux using removable media. In versions before 0.9.3, the function pusb_get_tty_from_display_server reads /proc/<pid>/cmdline into a 4096-byte buffer and removes the NUL terminators, so a 4096-byte cmdline can leave the buffer unterminated and string searches read past the allocation. A local user can trigger this by starting a process with a long command line, and the read happens during PAM authentication when DISPLAY is set. The likely impact is a crash of the host PAM process (for example login or sshd) and a limited information disclosure.
Affected
- pam_usb versions before 0.9.3 (CNA record: affected < 0.9.3)
- Specifically the function pusb_get_tty_from_display_server in src/local.c
Fixed in
- Fixed in pam_usb 0.9.3
Workaround
Unknown.
Exploitation
- No evidence of active exploitation found.
- No public proof of concept found at the time of research.
- VulDB lists the entry with 0-day status, which reflects its own tracking and does not indicate active exploitation.
- NVD analysis was still pending (status Received).
Our recommendation
- Update pam_usb to version 0.9.3 during the next maintenance window, sooner on multi-user hosts where pam_usb is used for authentication.
- Check whether pam_usb is deployed in the PAM stack on your systems.
- Monitor for unexpected authentication service crashes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record (CNA) www.cve.org
- GitHub Security Advisory GHSA-gc6f-5hpq-ghxh github.com
- Release 0.9.3 github.com
- Fix commit d0a2e71 github.com
- Issue #411 github.com
- Pull request #426 github.com
- VulDB entry 435601 vuldb.com
- NVD summary via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:12.
Original description (NVD)
pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c (pusb_get_tty_from_display_server) allocates a 4096-byte cmdline buffer, reads up to 4096 bytes from /proc//cmdline, then replaces every NUL separator with a space. When read(2) returns exactly 4096 bytes for any process the function inspects, the buffer ends without a terminator and the subsequent strstr() calls scan past the allocation boundary. The function is invoked during normal PAM authentication when DISPLAY is set, so the read fires for every process at auth time. Consequences are bounded: strstr output is a Boolean substring match (limited info-disclosure surface) but a hostile heap layout can produce a SIGSEGV that terminates the host PAM process. This issue has been patched in version 0.9.3.
NVD references (5)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.