Cloudanix VulnDB

CVE-2022-28321

Critical · 9.8

CVSS

9.8

EPSS

1.6%

Published

Sep 19, 2022

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in system login controls can let unauthorized users log in over the network if their computer's address can't be looked up by name.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
Library
Class
Authentication Bypass
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

The pam_access.so module in Linux-PAM fails to enforce access restrictions when the connecting IP address cannot be resolved via DNS, allowing unauthorized SSH authentication.

Why it matters to the business

Attackers can gain unauthorized access to affected systems, leading to potential data breaches or system compromise, especially in environments using DNS-dependent access controls.

How an attack unfolds

An attacker attempts SSH login from an IP without DNS resolution; pam_access.so incorrectly permits access despite denial rules.

How to fix it

Upgrade Linux-PAM to version 1.5.2-6.1 or later on openSUSE Tumbleweed. Review and adjust pam_access configurations to avoid reliance on DNS resolution.

How to confirm the fix worked

Test SSH logins from non-resolvable IPs against access deny rules; verify module version is at least 1.5.2-6.1.

Typical attack path

  1. Identify target SSH service using pam_access
  2. Connect from IP without reverse DNS
  3. Bypass access control checks
  4. Authenticate successfully

How to detect it

Review authentication logs for successful logins from IPs that should be denied; check for absence of DNS resolution errors in pam logs.

What your security team should do

  • Prioritize patching openSUSE systems
  • Monitor for unusual SSH access
  • Consider alternative access control methods

The record

The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:18.04:LTS pam 0 1.1.8-3.6ubuntu2.18.04.4
Ubuntu:18.04:LTS pam 0 1.1.8-3.6ubuntu2.18.04.6
Ubuntu:20.04:LTS pam 0 1.3.1-5ubuntu4.4
Ubuntu:20.04:LTS pam 0 1.3.1-5ubuntu4.6
Ubuntu:22.04:LTS pam 0 1.4.0-11ubuntu2.1
Ubuntu:22.04:LTS pam 0 1.4.0-11ubuntu2.3
Ubuntu:Pro:14.04:LTS pam 0 1.1.8-1ubuntu2.2+esm1
Ubuntu:Pro:14.04:LTS pam 0 1.1.8-1ubuntu2.2+esm3
Ubuntu:Pro:16.04:LTS pam 0 1.1.8-3.2ubuntu2.3+esm2
Ubuntu:Pro:16.04:LTS pam 0 1.1.8-3.2ubuntu2.3+esm4

Related vulnerabilities