The vulnerability CVE-2024-10963 exists in the pam_access component of Pluggable Authentication Modules (PAM). Certain rules in the pam_access configuration file are mistakenly treated as hostnames, which can be exploited by an attacker to impersonate a trusted hostname. This improper hostname interpretation leads to an access control bypass, allowing unauthorized access to systems relying on pam_access for authentication policies. The flaw affects pam versions including 1.3.1, 1.5.1, and 1.6.0 as explicitly stated. Red Hat has issued security advisories and patches for Red Hat Enterprise Linux 9.4 Extended Update Support and other 9.x variants to address this issue. The CVSS v3.1 base score is 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact.

Successful exploitation of this vulnerability allows an attacker to bypass authentication controls by tricking the system into accepting a malicious hostname as trusted. This can lead to unauthorized access to services or terminals protected by pam_access, compromising system confidentiality and integrity. The vulnerability does not affect availability and does not require privileges or user interaction to exploit. No known exploits are reported in the wild at this time.

Red Hat has released official security updates that fix the improper hostname interpretation in pam_access. Users of affected Red Hat Enterprise Linux 9.4 Extended Update Support and related 9.x versions should apply the pam package updates as detailed in the Red Hat advisories RHSA-2024:10232 and RHSA-2024:10244. Refer to https://access.redhat.com/articles/11258 for update instructions. Applying these updates mitigates the vulnerability by correcting the hostname parsing logic. No additional mitigation steps are indicated by the vendor advisory.