Red Hat Enterprise Linux 7/8/9 PAM /etc/shadow information disclosure

Summaryinfo

A vulnerability was found in Red Hat Enterprise Linux 7/8/9. It has been rated as problematic. This affects an unknown function of the file /etc/shadow of the component PAM. This manipulation causes information disclosure. This vulnerability is registered as CVE-2024-10041. The attack needs to be launched locally. No exploit is available.

Detailsinfo

A vulnerability classified as problematic was found in Red Hat Enterprise Linux 7/8/9. Affected by this vulnerability is an unknown function of the file /etc/shadow of the component PAM. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. The summary by CVE is:

A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.

It is possible to read the advisory at access.redhat.com. This vulnerability is known as CVE-2024-10041 since 10/16/2024. The exploitation appears to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/01/2026). The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 211819 (RHEL 9 : pam (RHSA-2024:9941)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (211819) and CERT Bund (WID-SEC-2024-3493). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Amazon Linux 2
• Red Hat Enterprise Linux
• SUSE Linux
• Oracle Linux
• Gentoo Linux
• SUSE openSUSE
• IBM MQ
• IBM QRadar SIEM
• Dell NetWorker

Productinfo

Type

• Operating System

Vendor

• Red Hat

Name

• Enterprise Linux

Version

• 7
• 8
• 9

License

• commercial

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion