CVE-2024-10041

Description

A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.

Reserved 2024-10-16 | Published 2024-10-23 | Updated 2024-11-26 | Assigner redhat

Problem types

Insecure Storage of Sensitive Information

Product status

Default status
affected

0:1.3.1-36.el8_10 before *
unaffected

Default status
affected

0:1.5.1-21.el9_4 before *
unaffected

Default status
unknown

Default status
affected

Timeline

2024-10-16:	Reported to Red Hat.
2024-10-18:	Made public.

References

access.redhat.com/errata/RHSA-2024:10379 (RHSA-2024:10379) vendor-advisory

access.redhat.com/errata/RHSA-2024:9941 (RHSA-2024:9941) vendor-advisory

access.redhat.com/security/cve/CVE-2024-10041 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2319212 (RHBZ#2319212) issue-tracking

cve.org (CVE-2024-10041)

nvd.nist.gov (CVE-2024-10041)

Download JSON