mcdope pam_usb up to 0.9.2 TTY Display Server src/local.c pusb_get_tty_from_display_server heap-based overflow

Summaryinfo

A vulnerability was found in mcdope pam_usb up to 0.9.2. It has been classified as problematic. Affected by this issue is the function pusb_get_tty_from_display_server of the file src/local.c of the component TTY Display Server. This manipulation causes heap-based overflow. This vulnerability is handled as CVE-2026-64667. It is possible to launch the attack on the local host. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in mcdope pam_usb up to 0.9.2. Affected by this vulnerability is the function pusb_get_tty_from_display_server of the file src/local.c of the component TTY Display Server. The manipulation with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. The product writes past the end of a buffer that was allocated on the heap. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c (pusb_get_tty_from_display_server) allocates a 4096-byte cmdline buffer, reads up to 4096 bytes from /proc//cmdline, then replaces every NUL separator with a space. When read(2) returns exactly 4096 bytes for any process the function inspects, the buffer ends without a terminator and the subsequent strstr() calls scan past the allocation boundary. The function is invoked during normal PAM authentication when DISPLAY is set, so the read fires for every process at auth time. Consequences are bounded: strstr output is a Boolean substring match (limited info-disclosure surface) but a hostile heap layout can produce a SIGSEGV that terminates the host PAM process. This issue has been patched in version 0.9.3.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-64667 since 07/20/2026. The exploitation appears to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 0.9.3 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• mcdope

Name

• pam_usb

Version

• 0.9.0
• 0.9.1
• 0.9.2

Website

• Product: https://github.com/mcdope/pam_usb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion