CVE-2025-24031

PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. In versions 0.6.12 and prior, the pam_pkcs11 module segfaults when a user presses ctrl-c/ctrl-d when they are asked for a PIN. When a user enters no PIN at all, `pam_get_pwd` will never initialize the password buffer pointer and as such `cleanse` will try to dereference an uninitialized pointer. On my system this pointer happens to have the value 3 most of the time when running sudo and as such it will segfault. The most likely impact to a system affected by this issue is an availability impact due to a daemon that uses PAM crashing. As of time of publication, a patch for the issue is unavailable.

• CWE-476

• https://github.com/OpenSC/pam_pkcs11/blob/bb2e3f3a95e44fdf44b0d5a4b377db3179021380/src/pam_pkcs11/pam_pkcs11.c#L211
• https://github.com/OpenSC/pam_pkcs11/blob/bb2e3f3a95e44fdf44b0d5a4b377db3179021380/src/pam_pkcs11/pam_pkcs11.c#L797
• https://github.com/OpenSC/pam_pkcs11/security/advisories/GHSA-wvr3-c9x3-9mff
• https://github.com/OpenSC/pam_pkcs11/security/advisories/GHSA-wvr3-c9x3-9mff

Published

Feb 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-24026iTop is an web based IT Service Management tool. Versions pr…5.3
• CVE-2025-24027ps_contactinfo, a PrestaShop module for displaying store con…6.2
• CVE-2025-24028Joplin is a free, open source note taking and to-do applicat…9.6
• CVE-2025-24029Tuleap is an Open Source Suite to improve management of soft…5.3
• CVE-2025-2403A denial-of-service vulnerability due to improper prioritiza…8.7
• CVE-2025-24030Envoy Gateway is an open source project for managing Envoy P…7.1
• CVE-2025-24032PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 …9.2
• CVE-2025-24033@fastify/multipart is a Fastify plugin for parsing the multi…7.5
• CVE-2025-24034Himmelblau is an interoperability suite for Microsoft Azure …3.2
• CVE-2025-24035Sensitive data storage in improperly locked memory in Window…8.1
• CVE-2025-24036Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerabil…7
• CVE-2025-24039Visual Studio Code Elevation of Privilege Vulnerability7.3