OpenSC pam_pkcs11 up to 0.6.12 X.509 Certificate pam_pkcs11.conf default improper authentication

Summaryinfo

A vulnerability was found in OpenSC pam_pkcs11 up to 0.6.12. It has been classified as critical. This vulnerability affects unknown code of the file pam_pkcs11.conf of the component X.509 Certificate Handler. This manipulation of the argument default causes improper authentication. This vulnerability is handled as CVE-2025-24032. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical was found in OpenSC pam_pkcs11 up to 0.6.12. Affected by this vulnerability is an unknown code block of the file pam_pkcs11.conf of the component X.509 Certificate Handler. The manipulation of the argument default with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. Prior to version 0.6.13, if cert_policy is set to none (the default value), then pam_pkcs11 will only check if the user is capable of logging into the token. An attacker may create a different token with the user's public data (e.g. the user's certificate) and a PIN known to the attacker. If no signature with the private key is required, then the attacker may now login as user with that created token. The default to *not* check the private key's signature has been changed with commit commi6638576892b59a99389043c90a1e7dd4d783b921, so that all versions starting with pam_pkcs11-0.6.0 should be affected. As a workaround, in `pam_pkcs11.conf`, set at least `cert_policy = signature;`.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-24032 since 01/16/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 216206 (Debian dsa-5864 : libpam-pkcs11 - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.6.13 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (216206). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• OpenSC

Name

• pam_pkcs11

Version

• 0.6.0
• 0.6.1
• 0.6.2
• 0.6.3
• 0.6.4
• 0.6.5
• 0.6.6
• 0.6.7
• 0.6.8
• 0.6.9
• 0.6.10
• 0.6.11
• 0.6.12

License

• open-source

Website

• Product: https://github.com/OpenSC/pam_pkcs11/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion