High severity · published Jun 4, 2019
CVE-2019-12210
In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned
8.1
CVSS
2.1%
EPSS
No
On KEV
Description
In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Pam-u2f · Yubico
1.0.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-12210
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-12210
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00018.html
Exploit
http://www.openwall.com/lists/oss-security/2019/06/05/1
Release Notes
https://developers.yubico.com/pam-u2f/Release_Notes.html
Patch
https://github.com/Yubico/pam-u2f/commit/18b1914e32b74ff52000f10e97067e841e5fff62
More from Pam-u2f
7.5
CVE-2019-12209
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that…
6.8
CVE-2021-31924
Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass