The pam_usb module for Linux hardware authentication had out-of-memory guards implemented with assert() calls that are removed in release builds due to the NDEBUG macro. This causes allocation functions xmalloc(), xrealloc(), and xstrdup() to return NULL on failure without aborting. The codebase does not check for NULL returns and dereferences them directly, causing a NULL pointer dereference and crash. This crash in the PAM module disrupts authentication processes such as sudo and login, creating a local denial-of-service. The vulnerability affects versions prior to 0.9.0 and is resolved in 0.9.0.

The vulnerability causes a local denial-of-service by crashing the pam_usb PAM module during authentication attempts. This prevents users from successfully authenticating via sudo or login while the module is crashing. There is no impact on confidentiality or integrity, only availability is affected. Exploitation requires local access and the ability to induce memory pressure at authentication time. No known exploits are reported in the wild.

A fix is available in pam_usb version 0.9.0. Upgrading to version 0.9.0 or later remediates this vulnerability. Until upgrading, users should be aware that inducing memory pressure during authentication can cause denial-of-service. Patch status is not explicitly confirmed beyond the fix in 0.9.0; check the vendor advisory for current remediation guidance.