CVE-2024-9313: Canonical Authd Auth Bypass Vulnerability

CVE-2024-9313 Overview

Canonical's authd Pluggable Authentication Module (PAM) contains an authorization flaw that allows broker-managed users to impersonate other users managed by the same broker. The vulnerability affects authd versions prior to 0.3.5 and permits attackers to perform arbitrary PAM operations, including authentication, as any co-managed user. Because authd brokers identity for cloud identity providers on Ubuntu systems, exploitation grants unauthorized access to accounts belonging to other users of the same broker.

Critical Impact
An authenticated broker-managed user can authenticate as any other user handled by the same broker, breaking user isolation and enabling lateral movement across accounts on the affected host.

Affected Products

Canonical authd PAM module versions before 0.3.5
Ubuntu systems using authd for cloud identity brokering
Deployments integrating authd with external identity providers via broker plugins

Discovery Timeline

2024-10-03 - CVE-2024-9313 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9313

Vulnerability Analysis

The authd daemon acts as a PAM bridge between Linux hosts and external identity brokers, allowing cloud-managed identities to authenticate on Ubuntu systems. Each broker manages a set of users, and authd is expected to enforce isolation between those users at the PAM layer.

In versions before 0.3.5, authd fails to bind PAM operations to the requesting user's verified identity when routing calls through a broker. A user already authenticated to a broker can therefore submit PAM requests targeting any other username handled by the same broker. The daemon accepts these requests and executes them under the target user's identity, including full authentication operations.

The impact extends beyond authentication bypass. Because PAM covers account, session, and password management stacks, an attacker can change credentials, open sessions, or modify account state for the impersonated user.

Root Cause

The flaw is an authorization gap [CWE-285-class] in the broker request-handling path. authd trusts the username supplied in a PAM operation without verifying that the currently authenticated broker principal is authorized to act on that username. Consult the GitHub Security Advisory GHSA-x5q3-c8rm-w787 for maintainer-published technical detail.

Attack Vector

Exploitation requires the attacker to already control a broker-managed account on the target system. From that position, the attacker issues PAM operations naming a different user managed by the same broker. authd performs the operation against the target account, granting authentication or account-modification capability without the target user's consent.

No verified public exploit code is available at the time of writing. The vulnerability mechanism is documented in the vendor advisory linked above.

Detection Methods for CVE-2024-9313

Indicators of Compromise

Successful PAM authentications for a broker-managed user originating from a session or process owned by a different broker-managed user.
Unexpected authd broker requests referencing usernames that do not match the invoking Unix user identity.
PAM account or password-change events for broker-managed users without corresponding administrator or self-service activity.

Detection Strategies

Correlate authd daemon logs with auth.log and journalctl -u authd entries to identify username mismatches between the invoker and the PAM target.
Alert on any authentication success where the PAM PAM_RUSER and PAM_USER values differ for broker-managed accounts.
Baseline broker-managed user authentication patterns and flag deviations such as cross-user session starts or off-hours password changes.

Monitoring Recommendations

Forward PAM, sshd, and authd logs to a centralized analytics platform for cross-host correlation.
Monitor the installed authd package version across the fleet and alert on hosts running versions earlier than 0.3.5.
Track broker configuration files under /etc/authd/ for unauthorized modifications that could widen the attack surface.

How to Mitigate CVE-2024-9313

Immediate Actions Required

Upgrade authd to version 0.3.5 or later on all affected Ubuntu hosts.
Audit broker-managed user accounts for unexpected authentications, password changes, or session activity since authd was deployed.
Rotate credentials for any broker-managed user showing anomalous PAM activity.

Patch Information

Canonical fixed the vulnerability in authd0.3.5. Refer to the GitHub Security Advisory GHSA-x5q3-c8rm-w787 and the CVE-2024-9313 record for release details and fixed-version metadata. Apply updates through the standard Ubuntu package channels.

Workarounds

Restrict the set of users provisioned through each broker to reduce the impersonation blast radius until patching is complete.
Disable authd PAM integration on hosts that do not require cloud identity brokering.
Require multi-factor authentication at the identity provider so that PAM-level impersonation alone cannot complete a full authentication flow.

bash

# Verify installed authd version and upgrade on Ubuntu
dpkg -l | grep -E '^ii\s+authd\s'
sudo apt update
sudo apt install --only-upgrade authd
dpkg -s authd | grep -i version