mcdope vulnerabilities and threats

pam_usb versions prior to 0.9.0 are vulnerable to an XML Injection (Blind XPath Injection) due to improper validation of user- and device-supplied identifiers used in XPath queries against /etc/pamusb.conf. This allows injection of arbitrary XPath predicates. The vulnerability is fixed in version 0.9.0. The CVSS score is 6.5, indicating a medium severity issue.

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pam_usb helper tools resolved external binaries through the PATH environment variable rather than using absolute paths. An attacker who can influence the process environment during PAM authentication or tool execution could substitute malicious binaries. The affected tools are pamusb-check (src/tmux.c), pamusb-conf (tools/pamusb-conf), and pamusb-keyring-unlock-gnome (tools/pamusb-keyring-unlock-gnome). This vulnerability is fixed in 0.9.0.

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, when a PAM service is configured with deny_remote=false in pam_usb (commonly done for display managers such as gdm-password or lightdm to bypass process/TTY heuristics for local sessions), the PAM_RHOST check in pusb_do_auth() is also skipped. PAM_RHOST is set by remote daemons (sshd, XDMCP servers) to identify the remote client address. Because the check is gated inside if (opts.deny_remote), a genuine remote XDMCP connection reaches the USB device authentication step instead of being rejected. This vulnerability is fixed in 0.9.1.

A heap-based buffer overflow vulnerability exists in pam_usb versions prior to 0.9.1 due to improper heap memory allocation when processing the number of devices from the configuration file. On 32-bit systems, integer overflow causes an undersized allocation, leading to heap overflow during array writes. This vulnerability has a CVSS score of 6.7 and can impact confidentiality, integrity, and availability. The issue is fixed in version 0.9.1.

CVE-2026-48066 is a race condition vulnerability in pam_usb versions prior to 0.9.1. The issue arises from a process-wide static pointer in src/log.c that is overwritten on every PAM invocation with the address of a stack-local variable, violating PAM's re-entrancy requirements. This creates a data race when multiple threads invoke the PAM stack concurrently. The vulnerability has a medium severity with a CVSS score of 5.7 and is fixed in version 0.9.1.

A vulnerability in pam_usb versions prior to 0.9.1 causes the software to silently ignore permission errors when accessing input device nodes, leading to a false negative detection of virtual input devices. This results in the authentication process continuing without denial when it should not, potentially allowing unauthorized access. The issue is fixed in version 0.9.1.