CVE-2025-23013

What it actually does

Authentication bypass in pam-u2f PAM module allowing local privilege escalation to root in certain configurations when using FIDO authenticators on Linux or macOS.

Why it matters to the business

Unprivileged local users may gain full system control, leading to complete compromise of affected authentication setups and potential ransomware or data theft impact.

How an attack unfolds

An attacker with local unprivileged access crafts or manipulates the authentication flow against a misconfigured pam-u2f installation to bypass the second factor check, escalating to root without valid credentials beyond an optional password.

How to fix it

Upgrade pam-u2f to version 1.3.1 or later. Review PAM configuration files for secure settings and test authentication flows after update.

How to confirm the fix worked

Verify pam-u2f version is at least 1.3.1, review PAM stack configuration for the reported bypass conditions, and confirm successful FIDO authentication requires the authenticator.

Typical attack path

1. Obtain local unprivileged shell on target system
2. Identify pam-u2f configuration and module version below 1.3.1
3. Trigger authentication path that bypasses FIDO verification
4. Escalate to root privileges via the bypassed PAM stack

How to detect it

Review authentication logs for unexpected root logins or PAM module errors around pam-u2f, inspect process execution of su/sudo following local user sessions, and check for version strings of pam-u2f below 1.3.1 on disk.

• /usr/lib/security/pam_u2f.so
• pam_u2f version < 1.3.1
• unexpected sudo or su execution after local login

What your security team should do

• Immediately upgrade pam-u2f to 1.3.1 across all Linux and macOS systems
• Audit PAM configurations for affected modules and restrict local user access where possible
• Monitor for unexpected privilege escalations from unprivileged accounts