Threats Tagged 'cve-2024-10041'

Two security vulnerabilities have been identified in the Pluggable Authentication Modules (PAM) used in Red Hat Enterprise Linux 8. These include a vulnerability in libpam that allows reading hashed passwords (CVE-2024-10041) and an improper hostname interpretation in pam_access that can lead to access control bypass (CVE-2024-10963). Red Hat has issued an important security advisory with updates to address these issues. The vulnerabilities affect multiple architectures of Red Hat Enterprise Linux 8, including extended life cycle versions. Users are advised to apply the provided security update to remediate these issues.

A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.