The pam_usb tool provides hardware authentication for Linux systems using removable media. In versions before 0.8.7, the pamusb-pinentry component unsafely executes the binary or script specified by the PINENTRY_FALLBACK_APP environment variable without validating its content. This improper neutralization of special elements (CWE-78) allows an attacker with the ability to set environment variables prior to pamusb-pinentry execution to run arbitrary commands with the privileges of the pam_usb process. The vulnerability is resolved in version 0.8.7.

Successful exploitation allows an attacker with limited privileges (local user) to execute arbitrary code with the privileges of the pam_usb tool chain, potentially leading to full system compromise. The CVSS vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Upgrade pam_usb to version 0.8.7 or later, where this vulnerability is fixed. Since no official patch link or advisory is provided, users should verify the version in use and apply the update accordingly. Until upgraded, restrict the ability to set environment variables affecting pamusb-pinentry execution to trusted users only.