Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
oath-toolkit PAM module can let attacker become root
published 2 years ago
Summary
Versions of the oath-toolkit PAM module before 2.6.12 mishandle access to its user list file, allowing a local user to trick the module into running code with root rights. This can let an attacker gain full system control. Update to version 2.6.12 or later and ensure the users file is protected with strict permissions.
What to do
- Update azure oath-toolkit to version 2.6.9-2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | oath-toolkit |
< 2.6.9-2 Fix: upgrade to 2.6.9-2
|
Original advisory text
CVE-2024-47191 affecting package oath-toolkit for versions less than 2.6.9-2
pam_oath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context of PAM code running as root, it mishandles usersfile access, such as by calling fchown in the presence of a symlink.
References
Timeline
Published9 Oct 2024
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-50124 · OSV
Track software like this
Free during beta