CVE-2024-22365

What it actually does

A local attacker can create a FIFO (named pipe) in place of an expected directory, causing the protect_dir function's openat call (lacking O_DIRECTORY) to block indefinitely and stall the PAM login process.

Why it matters to the business

Attackers with local access can prevent legitimate users from logging in, leading to operational disruption on systems that rely on this PAM version for authentication.

How an attack unfolds

An attacker with local shell access runs mkfifo to replace a directory path used by PAM's protect_dir logic; when a login attempt triggers the openat without the directory flag, the process hangs, resulting in a denial of service for authentication.

How to fix it

Upgrade linux-pam to version 1.6.0 or later, or apply the fix from commit 031bb5a5d0d950253b68138b498dc93be69a64cb; rebuild and redeploy any packages that depend on the patched PAM library.

How to confirm the fix worked

Confirm the installed PAM version is 1.6.0 or newer; review source for the presence of O_DIRECTORY in the protect_dir openat call; test login flows after upgrade to ensure no blocking occurs.

Typical attack path

1. Obtain local user access on the target system
2. Identify or create the target path used by protect_dir
3. Execute mkfifo to place a named pipe at that location
4. Trigger an authentication attempt that invokes the vulnerable PAM code path
5. Observe the login process enter a blocked state

How to detect it

Search system and authentication logs for processes stuck in openat or protect_dir calls; monitor for unexpected FIFO creation in directories used by PAM modules; review audit logs for mkfifo invocations around login failures.

What your security team should do

• Prioritize patching systems that expose PAM authentication to untrusted local users
• Apply the commit or upgrade to 1.6.0 across all affected distributions
• Monitor for stalled login processes as an interim detection measure
• Review downstream package dependencies for the fixed version