[ASA-202106-16] pam-u2f: authentication bypass

[Jonas Witschel]

Arch Linux Security Advisory ASA-202106-16
==========================================

Severity: Medium
Date    : 2021-06-01
CVE-ID  : CVE-2021-31924
Package : pam-u2f
Type    : authentication bypass
Remote  : No
Link    : https://security.archlinux.org/AVG-2001

Summary
=======

The package pam-u2f before version 1.1.1-1 is vulnerable to
authentication bypass.

Resolution
==========

Upgrade to 1.1.1-1.

# pacman -Syu "pam-u2f>=1.1.1-1"

The problem has been fixed upstream in version 1.1.1.

Workaround
==========

None.

Description
===========

Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the
pam-u2f configuration and the application used, could lead to a local
PIN bypass. This issue does not allow user presence (touch) or
cryptographic signature verification to be bypassed, so an attacker
would still need to physically possess and interact with the YubiKey or
another enrolled authenticator.

If pam-u2f is configured to require PIN authentication, and the
application using pam-u2f allows the user to submit NULL as the PIN,
pam-u2f will attempt to perform a FIDO2 authentication without PIN. If
this authentication is successful, the PIN requirement is bypassed.

Impact
======

A local attacker could authenticate with a U2F device without having to
enter the correct PIN.

References
==========

https://www.yubico.com/support/security-advisories/ysa-2021-03/
https://github.com/Yubico/pam-u2f/issues/175
https://github.com/Yubico/pam-u2f/pull/180
https://github.com/Yubico/pam-u2f/commit/6059b057dd9b6d0164fc16f9422c0d728f902bb5
https://github.com/Yubico/pam-u2f/commit/1ffd435c9c26e8c3122ea121d3e0b55cb81b1a46
https://security.archlinux.org/CVE-2021-31924
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20210603/b5b05659/attachment.sig>