CVE-2024-47191

What it actually does

The pam_oath.so module mishandles access to the usersfile by performing fchown operations on what may be a symbolic link while running with root privileges in PAM context, allowing a local attacker to change ownership of arbitrary files.

Why it matters to the business

Attackers with local access could gain root privileges, leading to complete system compromise and potential data breaches or service disruption on systems relying on oath-toolkit for authentication.

How an attack unfolds

A local attacker creates a symbolic link pointing to a target file owned by root, configures the PAM module to use a usersfile path that resolves to the link, and triggers authentication which causes the module to chown the target file, potentially allowing further exploitation to root.

How to fix it

Upgrade oath-toolkit to version 2.6.12 or apply the fix from commit 3235a52f6b87cd1c5da6508f421ac261f5e33a70. Ensure pam_oath.so is updated on all affected systems.

How to confirm the fix worked

Verify the installed version of oath-toolkit is 2.6.12 or later, and test PAM authentication flows with oath to confirm no symlink traversal occurs.

Typical attack path

1. Identify a target file for ownership change
2. Create symlink from usersfile path to target
3. Trigger PAM authentication event
4. Exploit resulting file ownership change for privilege escalation

How to detect it

Review system logs for unexpected chown operations or PAM authentication events around the time of suspected compromise; examine file ownership anomalies on critical system files.

What your security team should do

• Immediately upgrade oath-toolkit to the fixed version
• Audit systems using oath-toolkit for PAM configurations
• Monitor for unauthorized file ownership changes