CVE-2026-47270

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47270", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-18T23:03:37.229Z", "datePublished": "2026-05-27T20:10:37.108Z", "dateUpdated": "2026-05-28T13:25:31.065Z"}, "containers": {"cna": {"title": "pam_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny_remote result", "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "lang": "en", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-j3xw-vc43-x7jg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-j3xw-vc43-x7jg"}, {"name": "https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51", "tags": ["x_refsource_MISC"], "url": "https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51"}, {"name": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd", "tags": ["x_refsource_MISC"], "url": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd"}], "affected": [{"vendor": "mcdope", "product": "pam_usb", "versions": [{"version": "< 0.9.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T20:10:37.108Z"}, "descriptions": [{"lang": "en", "value": "pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb is a PAM module loaded into the host process (sudo, login, GDM, GNOME Shell). Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the deny_remote feature called the non-reentrant strtok(), which stores state in a single global pointer. If two authentications race, one thread's strtok() call can overwrite the other's in-progress tokenisation pointer, causing incorrect parsing of the tmux session data or the /proc environ scan that backs the remote-session detection logic. Additionally, pusb_tmux_get_client_tty() passed the raw pointer returned by getenv(TMUX) directly to strtok(). getenv() returns a pointer into the live process environment block; strtok() inserts NUL bytes into that block, permanently corrupting the TMUX variable for subsequent code running in the same process. In long-lived display managers this affects all future authentications in that process. The combined effect can cause deny_remote=true to return an incorrect decision for a remote session, or an incorrect decision for a local session, depending on thread interleaving. This vulnerability is fixed in 0.9.0."}], "source": {"advisory": "GHSA-j3xw-vc43-x7jg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-28T13:25:20.725360Z", "id": "CVE-2026-47270", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T13:25:31.065Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47270", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-28T13:25:20.725360Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T13:25:27.720Z"}}], "cna": {"title": "pam_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny_remote result", "source": {"advisory": "GHSA-j3xw-vc43-x7jg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "mcdope", "product": "pam_usb", "versions": [{"status": "affected", "version": "< 0.9.0"}]}], "references": [{"url": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-j3xw-vc43-x7jg", "name": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-j3xw-vc43-x7jg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51", "name": "https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd", "name": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb is a PAM module loaded into the host process (sudo, login, GDM, GNOME Shell). Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the deny_remote feature called the non-reentrant strtok(), which stores state in a single global pointer. If two authentications race, one thread's strtok() call can overwrite the other's in-progress tokenisation pointer, causing incorrect parsing of the tmux session data or the /proc environ scan that backs the remote-session detection logic. Additionally, pusb_tmux_get_client_tty() passed the raw pointer returned by getenv(TMUX) directly to strtok(). getenv() returns a pointer into the live process environment block; strtok() inserts NUL bytes into that block, permanently corrupting the TMUX variable for subsequent code running in the same process. In long-lived display managers this affects all future authentications in that process. The combined effect can cause deny_remote=true to return an incorrect decision for a remote session, or an incorrect decision for a local session, depending on thread interleaving. This vulnerability is fixed in 0.9.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T20:10:37.108Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47270", "state": "PUBLISHED", "dateUpdated": "2026-05-28T13:25:31.065Z", "dateReserved": "2026-05-18T23:03:37.229Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-27T20:10:37.108Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pam_usb", "vendor": "mcdope", "versions": [{"status": "affected", "version": "< 0.9.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb is a PAM module loaded into the host process (sudo, login, GDM, GNOME Shell). Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the deny_remote feature called the non-reentrant strtok(), which stores state in a single global pointer. If two authentications race, one thread's strtok() call can overwrite the other's in-progress tokenisation pointer, causing incorrect parsing of the tmux session data or the /proc environ scan that backs the remote-session detection logic. Additionally, pusb_tmux_get_client_tty() passed the raw pointer returned by getenv(TMUX) directly to strtok(). getenv() returns a pointer into the live process environment block; strtok() inserts NUL bytes into that block, permanently corrupting the TMUX variable for subsequent code running in the same process. In long-lived display managers this affects all future authentications in that process. The combined effect can cause deny_remote=true to return an incorrect decision for a remote session, or an incorrect decision for a local session, depending on thread interleaving. This vulnerability is fixed in 0.9.0."}, {"lang": "es", "value": "pam_usb proporciona autenticaci\u00f3n de hardware para Linux utilizando medios extra\u00edbles ordinarios. Antes de la versi\u00f3n 0.9.0, pam_usb es un m\u00f3dulo PAM cargado en el proceso anfitri\u00f3n (sudo, login, GDM, GNOME Shell). Los gestores de pantalla como GDM ejecutan m\u00faltiples hilos de autenticaci\u00f3n concurrentes. Tres funciones utilizadas por la caracter\u00edstica deny_remote llamaron a la funci\u00f3n strtok() no reentrante, la cual almacena el estado en un \u00fanico puntero global. Si dos autenticaciones compiten, la llamada a strtok() de un hilo puede sobrescribir el puntero de tokenizaci\u00f3n en curso del otro, causando un an\u00e1lisis incorrecto de los datos de la sesi\u00f3n de tmux o del escaneo de /proc environ que respalda la l\u00f3gica de detecci\u00f3n de sesiones remotas. Adem\u00e1s, pusb_tmux_get_client_tty() pas\u00f3 el puntero sin procesar devuelto por getenv(TMUX) directamente a strtok(). getenv() devuelve un puntero al bloque de entorno del proceso activo; strtok() inserta bytes NUL en ese bloque, corrompiendo permanentemente la variable TMUX para el c\u00f3digo subsiguiente que se ejecute en el mismo proceso. En gestores de pantalla de larga duraci\u00f3n, esto afecta a todas las autenticaciones futuras en ese proceso. El efecto combinado puede hacer que deny_remote=true devuelva una decisi\u00f3n incorrecta para una sesi\u00f3n remota, o una decisi\u00f3n incorrecta para una sesi\u00f3n local, dependiendo del entrelazado de hilos. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.9.0."}], "id": "CVE-2026-47270", "lastModified": "2026-10-26T12:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47270", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-28T13:25:20.725360Z", "version": "2.0.3"}}]}, "published": "2026-05-27T21:16:18.950", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/mcdope/pam_usb/commit/94f1640a61d49dfaf38e782680a52f01d5bf8b51"}, {"source": "security-advisories@github.com", "url": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd"}, {"source": "security-advisories@github.com", "url": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-j3xw-vc43-x7jg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.9.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "pam_usb", "source": "cna", "vendor": "mcdope"}, "product": "pam_usb", "vendor": "mcdope"}], "created": "2026-05-27T22:45:44.572055+00:00", "updated": "2026-05-29T15:50:03.254418+00:00", "vendors": ["mcdope", "mcdope$PRODUCT$pam_usb"]}