CVE-2025-24032 Details
Description
PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. Prior to version 0.6.13, if cert_policy is set to none (the default value), then pam_pkcs11 will only check if the user is capable of logging into the token. An attacker may create a different token with the user's public data (e.g. the user's certificate) and a PIN known to the attacker. If no signature with the private key is required, then the attacker may now login as user with that created token. The default to *not* check the private key's signature has been changed with commit commi6638576892b59a99389043c90a1e7dd4d783b921, so that all versions starting with pam_pkcs11-0.6.0 should be affected. As a workaround, in `pam_pkcs11.conf`, set at least `cert_policy = signature;`.
An authentication bypass vulnerability has been identified in the OpenSC PAM-PKCS#11 module, prior to version 0.6.13. This module allows X.509 certificate-based user login. When the 'cert_policy' is set to 'none' (the default), the module only verifies if a user can log into the token. This creates an opportunity for an attacker to craft a token using the user's public data, such as their certificate, and a PIN known to them. If the private key's signature is not required for authentication, the attacker can log in as the user with the forged token. This vulnerability affects all versions of PAM-PKCS#11 starting from 0.6.0, with the exception of 0.6.13, which includes the necessary fix.
Users can mitigate this vulnerability by updating to PAM-PKCS#11 version 0.6.13 or later. For those unable to update, the 'cert_policy' setting can be changed to 'signature' in the PAM-PKCS#11 configuration file.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Feb 10, 2025CISA-ADP
Assessed Feb 10, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenSC pam_pkcs11 | All versions |
CPE
Remediation
| |
| Debian | < 0.6.12 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2025 | CVE Modified | CVE |
| Feb 18, 2025 | CVE Modified | CVE |
| Feb 10, 2025 | New CVE Received | [email protected] |