OATH Toolkit pam_oath Privilege Escalation via ${HOME} (CVE-2024-47191)

From this webpage screenshot, we can extract the following key information about the vulnerability: 1. Vulnerability Description: - Vulnerability Name: OATH Toolkit pam_oath usersfile ${HOME} privilege escalation (CVE-2024-47191) - Vulnerability Type: Privilege Escalation 2. Affected Components: - liboath and pam_oath components of the OATH Toolkit. 3. Affected Versions: - liboath and pam_oath components from versions 2.6.7 to 2.6.11. 4. Exploitation: - Users can exploit the vulnerability by using as the path, leading to privilege escalation. - By creating a symbolic link pointing to privileged files, users can modify those files and gain root privileges. 5. Remediation: - Upgrade to version 2.6.12, which fixes this vulnerability. - Apply the liboath patch to fix the improper use of . 6. Vulnerability Details: - The function in liboath uses , which enables privilege escalation. - The code runs under the root user, allowing non-root users to modify files controlled by root. 7. Affected Configurations: - Configurations that use as the path. 8. Related Work: - The code logic was influenced by earlier versions. - GitLab’s SAST and Coverity scans were used to identify and fix the vulnerability. 9. History: - The issue was reported by Fabian Vogt and confirmed by Matthias Gerstner as a GitLab confidential issue. - The issue was notified via SMS on August 29, 2024. 10. Contributors: - The vulnerability was discovered by Fabian Vogt. - The initial patch was developed by Matthias Gerstner. - An additional portable patch was developed by Simon Josefsson. This information helps in understanding the nature, scope of impact, and how to remediate and prevent the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

OATH Toolkit pam_oath Privilege Escalation via ${HOME} (CVE-2024-47191)