CVE-2025-24032: PAM-PKCS#11 Auth Bypass Vulnerability

CVE-2025-24032 Overview

CVE-2025-24032 is a critical authentication bypass vulnerability in PAM-PKCS#11, a Linux-PAM login module that enables X.509 certificate-based user authentication. When the cert_policy configuration is set to none (the default value), the module only verifies that a user can log into a token without requiring a cryptographic signature from the private key. This fundamental flaw allows attackers to forge tokens containing a user's public certificate data and authenticate as that user using a PIN they control.

Critical Impact

Attackers can impersonate legitimate users by creating counterfeit tokens with copied public certificate data, completely bypassing authentication controls on systems using the default PAM-PKCS#11 configuration.

Affected Products

• PAM-PKCS#11 versions 0.6.0 through 0.6.12
• Linux systems using PAM-PKCS#11 with default cert_policy = none configuration
• Any deployment relying on X.509 certificate-based authentication via PAM-PKCS#11

Discovery Timeline

• February 4, 2025 - Version 0.6.13 released with security fix
• February 10, 2025 - CVE-2025-24032 published to NVD
• May 21, 2025 - Last updated in NVD database

Technical Details for CVE-2025-24032

Vulnerability Analysis

This vulnerability stems from an insecure default configuration in PAM-PKCS#11's certificate verification policy. The module's authentication mechanism was designed to verify that a user possesses a valid token, but when cert_policy is set to none, it fails to cryptographically prove possession of the corresponding private key. This allows an attacker who has access to a user's public certificate (which is often publicly available or easily obtained) to create a cloned token that passes authentication checks.

The vulnerability affects all versions from pam_pkcs11-0.6.0 onwards, introduced by commit 6638576892b59a99389043c90a1e7dd4d783b921, which changed the default behavior to skip private key signature verification. The CWE classification is CWE-287 (Improper Authentication), accurately reflecting the core issue of failing to properly authenticate users through cryptographic proof of identity.

Root Cause

The root cause is the default cert_policy = none configuration that bypasses signature verification. In this state, PAM-PKCS#11 only checks whether a user can successfully authenticate to a token (e.g., by entering a correct PIN), but does not require the token to prove possession of the private key by generating a cryptographic signature. Since public certificates and their associated data are inherently public, this design allows anyone with access to a user's certificate to create a fraudulent token.

The fix inverts the logic from signature_policy to no_signature_policy, making signature verification the default behavior:

 struct cert_policy_st {
 	int ca_policy;
 	int crl_policy;
-	int signature_policy;
+	int no_signature_policy;
 	const char *ca_dir;
 	const char *crl_dir;
 	const char *nss_dir;

Source: OpenSC Commit Update

Attack Vector

The attack vector is network-based and requires the attacker to have physical or logical access to a system's authentication interface. The attack proceeds as follows:

1. The attacker obtains the target user's public X.509 certificate (often publicly available)
2. The attacker creates a new PKCS#11 token populated with the user's public certificate data
3. The attacker sets a PIN of their choosing on the fraudulent token
4. When authenticating, the attacker presents the forged token and enters their known PIN
5. PAM-PKCS#11 (with default configuration) accepts the authentication without verifying private key possession

The configuration update clarifies the new secure default behavior:

     support_threads = false;

     # Sets the Certificate verification policy. 
-    # "none"        Performs no verification
+    # "none"        Performs no verification, except (!) the signature
     # "ca"          Does CA check
     # "crl_online"  Downloads the CRL form the location given by the
     #               CRL distribution point extension of the certificate

Source: OpenSC Commit Update

Detection Methods for CVE-2025-24032

Indicators of Compromise

• Successful PAM authentication events from unrecognized or unexpected hardware tokens
• Authentication attempts using tokens with serial numbers not registered in organizational inventory
• Multiple authentication attempts from different tokens claiming the same user identity
• Log entries showing successful logins without corresponding smart card insertion events on legitimate workstations

Detection Strategies

• Review PAM-PKCS#11 configuration files (pam_pkcs11.conf) to verify cert_policy includes signature requirement
• Monitor authentication logs for anomalous token-based login patterns
• Implement hardware token inventory management and alert on unregistered token usage
• Deploy endpoint detection to correlate physical smart card reader events with authentication attempts

Monitoring Recommendations

• Enable verbose logging in PAM-PKCS#11 by setting appropriate debug levels
• Centralize and correlate authentication logs across all systems using certificate-based authentication
• Establish baselines for normal token usage patterns and alert on deviations
• Audit user certificate repositories for unauthorized access or extraction attempts

How to Mitigate CVE-2025-24032

Immediate Actions Required

• Update PAM-PKCS#11 to version 0.6.13 or later immediately
• If update is not immediately possible, apply the configuration workaround by setting cert_policy = signature; in pam_pkcs11.conf
• Audit all systems using PAM-PKCS#11 for certificate-based authentication to identify affected deployments
• Review recent authentication logs for any suspicious token-based login activity

Patch Information

The vulnerability is resolved in PAM-PKCS#11 version 0.6.13, released on February 4, 2025. The fix changes the default behavior to require signature verification, ensuring that authentication requires cryptographic proof of private key possession. Multiple commits address this vulnerability, including fixes to the core verification logic and configuration file updates.

For detailed patch information, see the OpenSC Release Tag 0.6.13 and the GitHub Security Advisory GHSA-8r8p-7mgp-vf56. Debian users should refer to the Debian LTS Announcement for distribution-specific updates.

Workarounds

• Set cert_policy = signature; in pam_pkcs11.conf to enforce signature verification
• Consider implementing additional authentication factors while awaiting patching
• Restrict physical access to systems using certificate-based authentication
• Monitor for unauthorized token creation or certificate extraction attempts

# Configuration example - Mitigation in pam_pkcs11.conf
# Edit /etc/pam_pkcs11/pam_pkcs11.conf
# Locate the cert_policy directive and modify as follows:

# Change from:
# cert_policy = none;

# To require signature verification:
cert_policy = signature;

# For additional security, combine with CA verification:
# cert_policy = ca,signature;

# Restart PAM services after configuration change
systemctl restart sshd  # If using SSH with PAM