Description
PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. In versions 0.6.12 and prior, the pam_pkcs11 module segfaults when a user presses ctrl-c/ctrl-d when they are asked for a PIN. When a user enters no PIN at all, `pam_get_pwd` will never initialize the password buffer pointer and as such `cleanse` will try to dereference an uninitialized pointer. On my system this pointer happens to have the value 3 most of the time when running sudo and as such it will segfault. The most likely impact to a system affected by this issue is an availability impact due to a daemon that uses PAM crashing. As of time of publication, a patch for the issue is unavailable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenSC | pam_pkcs11 | <= 0.6.12 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pam-pkcs11 | No fix yet | — |
| Debian 13 | pam-pkcs11 | No fix yet | — |
| Debian 12 | pam-pkcs11 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | pam-pkcs11 | No fix yet | — |
| Ubuntu 26.04 LTS | pam-pkcs11 | No fix yet | — |
| Ubuntu 25.10 | pam-pkcs11 | No fix yet | — |
| Ubuntu 24.04 LTS | pam-pkcs11 | No fix yet | — |
| Ubuntu 22.04 LTS | pam-pkcs11 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | pam-pkcs11 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | pam-pkcs11 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | pam-pkcs11 | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | pam_pkcs11 | 0.6.10-150600.16.3.1 | SUSE-SU-2025:0689-1 |
| SLES 12 SP5 | pam_pkcs11 | 0.6.8-7.8.1 | SUSE-SU-2025:0688-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.0 | pam_pkcs11 | 0.6.12-3.1 | SUSE-SU-2025:20199-1 |
| SLE Micro 5.5 | pam_pkcs11 | 0.6.10-150100.3.6.1 | SUSE-SU-2025:0712-1 |
| SLE Micro 5.4 | pam_pkcs11 | 0.6.10-150100.3.6.1 | SUSE-SU-2025:0712-1 |
| SLE Micro 5.3 | pam_pkcs11 | 0.6.10-150100.3.6.1 | SUSE-SU-2025:0712-1 |
| SLE Micro 5.2 | pam_pkcs11 | 0.6.10-150100.3.6.1 | SUSE-SU-2025:0712-1 |
| SLE Micro 5.1 | pam_pkcs11 | 0.6.10-150100.3.6.1 | SUSE-SU-2025:0712-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | pam_pkcs11 | 0.6.10-150600.16.3.1 | SUSE-SU-2025:0689-1 |
Advisories 4
- SUSE-SU-2025:20199-1 Security update for pam_pkcs11 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:0689-1 Security update for pam_pkcs11 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0712-1 Security update for pam_pkcs11 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0688-1 Security update for pam_pkcs11 SUSE / openSUSE Security Updates · May 2, 2025
References
- https://github.com/OpenSC/pam_pkcs11/security/advisories/GHSA-wvr3-c9x3-9mff
- https://github.com/OpenSC/pam_pkcs11/blob/bb2e3f3a95e44fdf44b0d5a4b377db3179021380/src/pam_pkcs11/pam_pkcs11.c#L211
- https://github.com/OpenSC/pam_pkcs11/blob/bb2e3f3a95e44fdf44b0d5a4b377db3179021380/src/pam_pkcs11/pam_pkcs11.c#L797