CVE-2026-47271

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47271", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-18T23:03:37.229Z", "datePublished": "2026-05-27T20:08:02.552Z", "dateUpdated": "2026-05-28T13:38:47.997Z"}, "containers": {"cna": {"title": "pam_usb: OOM guards removed by -DNDEBUG cause NULL dereference and authentication process crash", "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "lang": "en", "description": "CWE-476: NULL Pointer Dereference", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-7rvx-jcc6-7hqq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-7rvx-jcc6-7hqq"}, {"name": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd", "tags": ["x_refsource_MISC"], "url": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd"}], "affected": [{"vendor": "mcdope", "product": "pam_usb", "versions": [{"version": "< 0.9.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T20:08:02.552Z"}, "descriptions": [{"lang": "en", "value": "pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, src/mem.c implemented out-of-memory guards for xmalloc(), xrealloc(), and xstrdup() using assert(data != NULL). The C standard specifies that all assert() expressions are compiled out when NDEBUG is defined at build time. NDEBUG is commonly defined in release and packaging builds (Debian, Fedora, Arch package flags all define it via -DNDEBUG in CFLAGS). With the guard removed, xmalloc/xrealloc/xstrdup silently return NULL on allocation failure. Every caller in the codebase dereferences the return value without a NULL check -- this is the intended design, as the guard was supposed to abort before the dereference. With the guard gone, any allocation failure causes a NULL pointer dereference, crashing the PAM module. A crash in a PAM module loaded by sudo or login causes authentication to fail for the duration of the crash, creating a local denial-of-service condition. An attacker who can induce memory pressure at authentication time can lock all users out of sudo and login. This vulnerability is fixed in 0.9.0."}], "source": {"advisory": "GHSA-7rvx-jcc6-7hqq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-28T13:38:36.351091Z", "id": "CVE-2026-47271", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T13:38:47.997Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47271", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T13:38:36.351091Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T13:38:44.311Z"}}], "cna": {"title": "pam_usb: OOM guards removed by -DNDEBUG cause NULL dereference and authentication process crash", "source": {"advisory": "GHSA-7rvx-jcc6-7hqq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "mcdope", "product": "pam_usb", "versions": [{"status": "affected", "version": "< 0.9.0"}]}], "references": [{"url": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-7rvx-jcc6-7hqq", "name": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-7rvx-jcc6-7hqq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd", "name": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, src/mem.c implemented out-of-memory guards for xmalloc(), xrealloc(), and xstrdup() using assert(data != NULL). The C standard specifies that all assert() expressions are compiled out when NDEBUG is defined at build time. NDEBUG is commonly defined in release and packaging builds (Debian, Fedora, Arch package flags all define it via -DNDEBUG in CFLAGS). With the guard removed, xmalloc/xrealloc/xstrdup silently return NULL on allocation failure. Every caller in the codebase dereferences the return value without a NULL check -- this is the intended design, as the guard was supposed to abort before the dereference. With the guard gone, any allocation failure causes a NULL pointer dereference, crashing the PAM module. A crash in a PAM module loaded by sudo or login causes authentication to fail for the duration of the crash, creating a local denial-of-service condition. An attacker who can induce memory pressure at authentication time can lock all users out of sudo and login. This vulnerability is fixed in 0.9.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476: NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T20:08:02.552Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47271", "state": "PUBLISHED", "dateUpdated": "2026-05-28T13:38:47.997Z", "dateReserved": "2026-05-18T23:03:37.229Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-27T20:08:02.552Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pam_usb", "vendor": "mcdope", "versions": [{"status": "affected", "version": "< 0.9.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, src/mem.c implemented out-of-memory guards for xmalloc(), xrealloc(), and xstrdup() using assert(data != NULL). The C standard specifies that all assert() expressions are compiled out when NDEBUG is defined at build time. NDEBUG is commonly defined in release and packaging builds (Debian, Fedora, Arch package flags all define it via -DNDEBUG in CFLAGS). With the guard removed, xmalloc/xrealloc/xstrdup silently return NULL on allocation failure. Every caller in the codebase dereferences the return value without a NULL check -- this is the intended design, as the guard was supposed to abort before the dereference. With the guard gone, any allocation failure causes a NULL pointer dereference, crashing the PAM module. A crash in a PAM module loaded by sudo or login causes authentication to fail for the duration of the crash, creating a local denial-of-service condition. An attacker who can induce memory pressure at authentication time can lock all users out of sudo and login. This vulnerability is fixed in 0.9.0."}, {"lang": "es", "value": "pam_usb proporciona autenticaci\u00f3n de hardware para Linux usando medios extra\u00edbles ordinarios. Antes de la versi\u00f3n 0.9.0, src/mem.c implementaba protecciones contra falta de memoria para xmalloc(), xrealloc() y xstrdup() usando assert(data != NULL). El est\u00e1ndar C especifica que todas las expresiones assert() se eliminan en la compilaci\u00f3n cuando NDEBUG se define en tiempo de construcci\u00f3n. NDEBUG se define com\u00fanmente en compilaciones de lanzamiento y empaquetado (las banderas de paquetes de Debian, Fedora, Arch lo definen todas a trav\u00e9s de -DNDEBUG en CFLAGS). Con la protecci\u00f3n eliminada, xmalloc/xrealloc/xstrdup devuelven NULL silenciosamente en caso de fallo de asignaci\u00f3n. Cada llamador en la base de c\u00f3digo desreferencia el valor de retorno sin una comprobaci\u00f3n de NULL -- este es el dise\u00f1o previsto, ya que se supon\u00eda que la protecci\u00f3n abortar\u00eda antes de la desreferencia. Sin la protecci\u00f3n, cualquier fallo de asignaci\u00f3n causa una desreferencia de puntero NULL, lo que provoca el bloqueo del m\u00f3dulo PAM. Un bloqueo en un m\u00f3dulo PAM cargado por sudo o login hace que la autenticaci\u00f3n falle durante la duraci\u00f3n del bloqueo, creando una condici\u00f3n local de denegaci\u00f3n de servicio. Un atacante que pueda inducir presi\u00f3n de memoria en el momento de la autenticaci\u00f3n puede bloquear a todos los usuarios de sudo y login. Esta vulnerabilidad se corrige en la versi\u00f3n 0.9.0."}], "id": "CVE-2026-47271", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.4, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47271", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-28T13:38:36.351091Z", "version": "2.0.3"}}]}, "published": "2026-05-27T20:16:39.580", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/mcdope/pam_usb/commit/d003e551b794a9e3774ff4720830fb7aadaa48bd"}, {"source": "security-advisories@github.com", "url": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-7rvx-jcc6-7hqq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.9.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "pam_usb", "source": "cna", "vendor": "mcdope"}, "product": "pam_usb", "vendor": "mcdope"}], "created": "2026-05-27T22:15:25.995085+00:00", "updated": "2026-05-29T15:50:04.664486+00:00", "vendors": ["mcdope", "mcdope$PRODUCT$pam_usb"]}