CVE-2024-22365: Linux PAM Denial of Service Vulnerability

CVE-2024-22365 Overview

CVE-2024-22365 is a denial of service vulnerability affecting Linux PAM (Pluggable Authentication Modules) versions prior to 1.6.0. The vulnerability allows local attackers to block login processes by exploiting a missing O_DIRECTORY flag in the openat call within the protect_dir function. By using mkfifo to create a named pipe (FIFO) in a specific location, an attacker can cause the authentication process to hang indefinitely, effectively preventing legitimate users from logging into the system.

Critical Impact

Local attackers with low privileges can completely block authentication processes, causing system-wide denial of service for login functionality.

Affected Products

• Linux PAM versions prior to 1.6.0
• Linux distributions using vulnerable PAM versions
• Systems relying on PAM for authentication services

Discovery Timeline

• 2024-01-18 - Vulnerability disclosed via Openwall OSS-Security Discussion
• 2024-02-06 - CVE CVE-2024-22365 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-22365

Vulnerability Analysis

This vulnerability stems from improper resource control (CWE-664) in Linux PAM's directory protection mechanism. When PAM attempts to open a directory for protection purposes, the openat system call is used without the O_DIRECTORY flag. This oversight allows the function to successfully open non-directory file types, including named pipes (FIFOs).

Named pipes are special file types that block on open operations until both a reader and writer are connected. When an attacker creates a FIFO at a location where PAM expects a directory, the openat call blocks indefinitely waiting for the other end of the pipe to be opened. Since this occurs during the authentication process, the entire login operation hangs, preventing user authentication.

The vulnerability requires local access and low privileges, limiting the attack surface to authenticated local users attempting to disrupt system access for other users or administrators.

Root Cause

The root cause is the missing O_DIRECTORY flag in the openat call within the protect_dir function. Without this flag, the system call does not verify that the target path is actually a directory before attempting to open it. The O_DIRECTORY flag specifically instructs the kernel to fail the operation if the target is not a directory, which would prevent the FIFO blocking attack.

The fix implemented in version 1.6.0 adds the O_DIRECTORY flag to the openat call, ensuring that only actual directories can be opened, and any attempt to open a FIFO or other non-directory file type will fail with an appropriate error rather than blocking.

Attack Vector

The attack requires local access to the system with low-level user privileges. An attacker can exploit this vulnerability through the following method:

1. Identify the directory path that PAM's protect_dir function will attempt to access during authentication
2. Use the mkfifo command to create a named pipe at the target location (or a component of the path)
3. Leave the FIFO in place without opening either end
4. When a legitimate user attempts to authenticate, PAM's openat call will block indefinitely on the FIFO
5. The login process becomes stuck, denying access to the user

This attack is particularly effective because it does not require elevated privileges to create the FIFO, and the blocking behavior persists until the attacking user removes the FIFO or the system is rebooted.

Detection Methods for CVE-2024-22365

Indicators of Compromise

• Presence of unexpected FIFO (named pipe) files in PAM-related directories or authentication paths
• Users reporting inability to log in while the system appears otherwise functional
• Hung authentication processes visible in process listings
• Processes stuck in uninterruptible sleep state related to PAM modules

Detection Strategies

• Monitor for mkfifo command execution in sensitive system directories using audit logging
• Implement file integrity monitoring for PAM configuration and module directories
• Use find commands to periodically scan for unexpected FIFO files: find /etc/security -type p
• Review system authentication logs for patterns of failed or incomplete login attempts

Monitoring Recommendations

• Enable auditd rules to track file creation operations in authentication-related directories
• Configure alerting for processes stuck in authentication-related system calls
• Monitor PAM module loading and execution for anomalous behavior
• Implement baseline monitoring for normal login process duration to detect prolonged authentication attempts

How to Mitigate CVE-2024-22365

Immediate Actions Required

• Upgrade Linux PAM to version 1.6.0 or later immediately
• Review systems for any existing FIFO files in PAM-related directories
• Restrict write access to directories involved in PAM authentication paths
• Monitor authentication services for signs of blocking or hanging

Patch Information

The vulnerability has been addressed in Linux PAM version 1.6.0. The fix adds the O_DIRECTORY flag to the openat call in the protect_dir function, ensuring that only actual directories can be opened. The specific commit addressing this issue is available in the GitHub Linux-PAM Commit Update.

Organizations should update to the patched version through their distribution's package manager or by obtaining the release from the GitHub Linux-PAM Release v1.6.0. Debian users should consult the Debian LTS Announcement for distribution-specific updates.

Workarounds

• Restrict directory permissions on PAM-related paths to prevent unauthorized file creation
• Implement SELinux or AppArmor policies to prevent FIFO creation in sensitive directories
• Use file system quotas and monitoring to detect and alert on unexpected file type creation
• Consider implementing additional access controls on authentication-critical directories

# Check for unexpected FIFO files in PAM directories
find /etc/pam.d /etc/security /lib/security /lib64/security -type p 2>/dev/null

# Audit rule to monitor file creation in PAM directories
auditctl -w /etc/security -p wa -k pam_security_changes