Description
login in util-linux-2.12a skips pam_acct_mgmt and chauth_tok when authentication is skipped, such as when a Kerberos krlogin session has been established, which might allow users to bypass intended access policies that would be enforced by pam_acct_mgmt and chauth_tok.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | util-linux | 2.17.2-9 | — |
| Debian 13 | util-linux | 2.17.2-9 | — |
| Debian 12 | util-linux | 2.17.2-9 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | util-linux | 2.12a-16.EL4.25 | RHSA-2007:0235 |
Advisories 1
- RHSA-2007:0235 Red Hat Security Advisory: util-linux security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 25098 third-party-advisory
- https://issues.rpath.com/browse/RPL-1359
- 25935 third-party-advisory
- 24321 vdb-entry
- RHSA-2007:0235 vendor-advisory
- MDKSA-2007:111 vendor-advisory
- 25692 third-party-advisory
- 25530 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-252.htm
- oval:org.mitre.oval:def:9689 vdb-entry signature
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=177331