CVE-2024-10041

What it actually does

The flaw permits a local attacker to leak sensitive in-memory secrets such as /etc/shadow passwords by sending input to stdin of a PAM process while training the branch predictor to speculatively execute an ROP chain.

Why it matters to the business

Exposure of authentication credentials on affected SUSE Enterprise Linux systems could enable unauthorized access, account compromise, and follow-on attacks in enterprise environments.

How an attack unfolds

An attacker with local access identifies a PAM-authenticating process, sends crafted characters to its stdin to trigger speculative execution, trains the branch predictor to follow an ROP gadget chain, and extracts leaked password material via a side channel.

How to fix it

Apply the vendor-supplied kgraft live patches: kgraft-patch-SLE12-SP1_Update_21 fixed in version 10-2.1 for both SUSE Linux Enterprise Server 12 SP1-LTSS and SUSE Linux Enterprise Server for SAP Applications 12 SP1.

How to confirm the fix worked

Confirm the installed kgraft-patch package reports version 10-2.1 or later via package manager queries and verify the patch is active with the kGraft tooling.

Typical attack path

1. Obtain local user access on the target host
2. Locate a process performing PAM authentication
3. Write input to the process stdin while priming the branch predictor
4. Observe side-channel results to recover secret memory contents

How to detect it

Review authentication logs and process creation events around PAM binaries for unexpected stdin activity; because the attack is speculative and leaves no persistent artifacts, post-exploitation detection is difficult without specialized side-channel monitoring.

What your security team should do

• Install the fixed kgraft-patch 10-2.1 on all affected SUSE 12 SP1 systems without delay
• Restrict local user accounts to the minimum necessary privileges
• Audit PAM configuration and authentication logs for anomalies