CVE-2024-10963

What it actually does

pam_access incorrectly interprets certain configuration rules as hostnames instead of intended access controls, allowing unauthorized network entities to satisfy hostname-based allow rules and bypass terminal or service access restrictions.

Why it matters to the business

Systems relying on pam_access for access control may grant entry to unauthorized users or services, increasing the risk of lateral movement, data exposure, or service misuse.

How an attack unfolds

An attacker initiates a connection from a controlled IP or hostname that matches a misparsed rule; pam_access evaluates the rule as a trusted hostname rather than a deny or conditional entry, resulting in successful authentication or session establishment where access should have been blocked.

How to fix it

Review and rewrite pam_access configuration files to ensure rules follow documented syntax and are not ambiguous; test rules in a non-production environment; apply any upstream pam updates that address rule parsing; consider replacing hostname-based rules with explicit IP or user-based controls where feasible.

How to confirm the fix worked

Audit pam_access.conf for rules that could be parsed as hostnames; use pam testing utilities or login attempts from controlled sources to verify that only intended entities are permitted; confirm updated packages are installed via package manager queries.

Typical attack path

1. Identify a target system that uses pam_access for login or service restrictions
2. Craft a connection attempt (SSH, console, or service) using an IP or apparent hostname that aligns with the misinterpreted rule
3. Trigger pam_access evaluation during authentication
4. Gain access due to the rule being treated as an allowed hostname match

How to detect it

Review authentication logs for successful logins or sessions from unexpected sources that should have been denied by pam_access rules; correlate with pam configuration changes or rule syntax anomalies.

What your security team should do

• Immediately audit all pam_access configurations for ambiguous rules
• Prioritize systems with network-exposed services or multi-user terminals
• Implement compensating controls such as host-based firewalls or additional authentication layers
• Monitor for future pam updates and schedule testing