In pam_usb 0.9.1 and earlier, the function usb_get_process_parent_id() does not initialize the parent process ID variable on failure. Subsequently, in pusb_local_login(), this variable is reused in a loop that traverses the process tree. If the process stat file cannot be read (e.g., if an ancestor process exits during authentication), the PID variable is not updated, causing the loop to never exit and resulting in a denial of service via an infinite loop. This vulnerability has been addressed in pam_usb version 0.9.2.

An attacker or environmental condition causing failure to read /proc/<pid>/stat can trigger an infinite loop in the authentication process, causing it to hang indefinitely. This results in a denial of service affecting authentication mechanisms such as sudo, sshd, or login. There is no impact on confidentiality or integrity.

Upgrade pam_usb to version 0.9.2 or later, where this infinite loop issue is fixed. Patch status is not explicitly stated in the vendor advisory, but the fix is included in version 0.9.2. Until upgraded, be aware that authentication processes may hang under certain conditions.