mcdope pam_usb up to 0.8.x on Linux PAM Module /proc strtok TMUX race condition

Summaryinfo

A vulnerability marked as problematic has been reported in mcdope pam_usb up to 0.8.x on Linux. The affected element is the function strtok of the file /proc of the component PAM Module. This manipulation of the argument TMUX causes race condition. The identification of this vulnerability is CVE-2026-47270. The attack can only be executed locally. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in mcdope pam_usb up to 0.8.x on Linux. It has been declared as problematic. Affected by this vulnerability is the function strtok of the file /proc of the component PAM Module. The manipulation of the argument TMUX with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb is a PAM module loaded into the host process (sudo, login, GDM, GNOME Shell). Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the deny_remote feature called the non-reentrant strtok(), which stores state in a single global pointer. If two authentications race, one thread's strtok() call can overwrite the other's in-progress tokenisation pointer, causing incorrect parsing of the tmux session data or the /proc environ scan that backs the remote-session detection logic. Additionally, pusb_tmux_get_client_tty() passed the raw pointer returned by getenv(TMUX) directly to strtok(). getenv() returns a pointer into the live process environment block; strtok() inserts NUL bytes into that block, permanently corrupting the TMUX variable for subsequent code running in the same process. In long-lived display managers this affects all future authentications in that process. The combined effect can cause deny_remote=true to return an incorrect decision for a remote session, or an incorrect decision for a local session, depending on thread interleaving. This vulnerability is fixed in 0.9.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-47270 since 05/19/2026. The exploitation appears to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.9.0 eliminates this vulnerability. Applying the patch 94f1640a61d49dfaf38e782680a52f01d5bf8b51 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• mcdope

Name

• pam_usb

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8

License

• open-source

Website

• Product: https://github.com/mcdope/pam_usb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion