CVE-2024-10041

A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2024:10379
https://access.redhat.com/errata/RHSA-2024:11250
https://access.redhat.com/errata/RHSA-2024:9941
https://access.redhat.com/security/cve/CVE-2024-10041	Mitigation Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2319212	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:linux-pam:linux-pam:-:*:*:*:*:*:*:*

OR	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*

History

18 Dec 2024, 10:15

Type	Values Removed	Values Added
References		() https://access.redhat.com/errata/RHSA-2024:11250 -

Information

Published : 2024-10-23 14:15

Updated : 2024-12-18 10:15

NVD link : CVE-2024-10041

Mitre link : CVE-2024-10041

CVE.ORG link : CVE-2024-10041

JSON object : View

Products Affected

redhat

enterprise_linux

linux-pam

linux-pam

CWE

CWE-922

Insecure Storage of Sensitive Information

NVD-CWE-noinfo

{"id": "CVE-2024-10041", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.0}]}, "published": "2024-10-23T14:15:03.970", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:10379", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:11250", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:9941", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2024-10041", "tags": ["Mitigation", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2319212", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-922"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-922"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en PAM. La informaci\u00f3n secreta se almacena en la memoria, donde el atacante puede hacer que el programa v\u00edctima se ejecute enviando caracteres a su entrada est\u00e1ndar (stdin). Mientras esto ocurre, el atacante puede entrenar al predictor de bifurcaciones para que ejecute una cadena ROP de manera especulativa. Esta falla podr\u00eda provocar la filtraci\u00f3n de contrase\u00f1as, como las que se encuentran en /etc/shadow mientras se realizan autenticaciones."}], "lastModified": "2024-12-18T10:15:05.850", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linux-pam:linux-pam:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "20ED7FC4-9FBB-4886-9FF0-BBBCBBE852D6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "secalert@redhat.com"}