CVE-2026-48980: pam_usb Environment Variable Injection & Local Privilege Escalation

Technical summary

The vulnerability stems from unsafe use of getenv() in pam_usb's local-versus-remote session detection logic. The module consults XRDP_SESSION, DISPLAY, and TMUX environment variables to classify session type, but does not sanitize or validate these values before using them in authentication decisions. When pam_usb executes in the context of setuid binaries (sudo, su), a local user can pre-set these environment variables in their shell before invoking the privileged command. The PAM module reads the attacker-controlled values, allowing session classification to be spoofed. The fix in 0.9.2 addresses this by either validating these inputs or switching to a more robust session-type detection mechanism that does not rely on user-modifiable environment variables.

Business impact

Organizations deploying pam_usb for hardware-based authentication on Linux systems face a local privilege escalation risk. An attacker with a valid local user account can authenticate as another user (or gain root access via sudo) without possessing the required USB hardware token, defeating the security model. This undermines the premise of hardware-backed authentication and could lead to lateral movement, data theft, or system compromise. The impact is limited to local attackers, but in shared-system or multi-tenant environments, this is a credible threat.

Affected systems

pam_usb versions prior to 0.9.2 are affected. This module is used on Linux systems where administrators have configured hardware token authentication via removable media. Exposure is highest on multi-user systems, shared servers, and environments where local user accounts are common. Systems running pam_usb 0.9.2 or later are not affected.

Exploitability

Exploitability is moderate. An attacker must have a valid local user account and shell access; remote exploitation is not possible. The attack requires knowledge of pam_usb's environment variable dependencies and the ability to set variables before invoking a privileged command—both within reach of a local user with basic shell knowledge. No special tools or advanced techniques are required. The CVSS score of 6.3 (Medium) reflects the local-only attack vector, low complexity once access is gained, and the requirement for existing user privileges, balanced against the high confidentiality and integrity impact (bypassing authentication).

Remediation

Upgrade pam_usb to version 0.9.2 or later. Administrators should verify the current version on all systems using 'pamtester' or checking /usr/lib/pam or /lib/pam directories for the pam_usb.so module version. After patching, test hardware token authentication workflows to ensure functionality is preserved. For systems unable to patch immediately, consider restricting shell access to trusted users and disabling sudo for accounts that do not require it, though these are incomplete mitigations.

Patch guidance

Obtain version 0.9.2 from the official pam_usb project repository or your Linux distribution's package manager. Most distributions (Debian, Ubuntu, Fedora, Arch) maintain pam_usb packages; use your distro's standard update mechanism (apt, dnf, pacman) to pull the patched version. Verify the installed version post-update: check the module's timestamp or use 'strings /usr/lib/pam/pam_usb.so | grep version' if available. Test authentication workflows on a non-critical system first to confirm hardware tokens still function correctly before rolling out to production.

Detection guidance

Monitor for signs of environment variable manipulation in authentication logs. Look for sudo or su commands preceded by shell commands setting XRDP_SESSION, DISPLAY, or TMUX variables. Systems with process auditing enabled (auditd on Linux) can create rules to track setuid binary execution and correlate with environment variable changes. Check for failed pam_usb authentication attempts followed immediately by successful privileged access with different session-type indicators. Review audit logs for discrepancies between expected session types and the values used by pam_usb during the authentication window.

Why prioritize this

Although not yet listed on CISA's KEV catalog, this vulnerability should be prioritized for organizations using pam_usb because it directly undermines the security model of hardware-based authentication. The local privilege escalation path is straightforward, and systems that have deployed hardware tokens are particularly attractive targets for local attackers seeking to escalate access. Patching is low-risk (version 0.9.2 is stable) and should be scheduled within 30 days.

Risk score, explained

The CVSS 3.1 score of 6.3 (Medium) reflects a local attack vector (AV:L), high complexity due to the need to manipulate environment variables in a specific context (AC:H), requirement for low privileges (PR:L), no user interaction needed (UI:N), and high impact on confidentiality and integrity (C:H/I:H). There is no availability impact (A:N) because the attack does not crash or disable the system. The score is justified but does not capture the elevated risk for organizations heavily reliant on hardware token authentication; such organizations should consider this a higher priority than the numerical score alone suggests.

Frequently asked questions