CVE-2026-48981: XXE Vulnerability in pam_usb Configuration Parsing

Technical summary

pam_usb prior to version 0.9.2 invokes xmlReadFile() with default flags (value 0) when parsing pam_usb.conf, which disables external entity (XXE) protection in libxml2. An attacker capable of writing to the configuration file can embed XXE payloads that trigger entity expansion during XML parsing. Because pam_usb.so operates in setuid contexts (sudo, su), the parse-time operations execute with elevated privileges, allowing file reads from restricted paths or outbound connections initiated by the privileged process. The vulnerability is rooted in CWE-611 (improper restriction of XML external entity reference processing).

Business impact

Exploitation could allow an authenticated attacker or insider with filesystem write access to exfiltrate sensitive files readable by root, or to trigger outbound network activity from authenticated sessions. In environments relying on pam_usb for multi-factor authentication, compromise of the configuration file undermines the authentication guarantee. The impact is primarily relevant to systems where pam_usb is actively used and where the threat model includes local attackers with partial filesystem write privileges. Organizations using pam_usb should prioritize patching to close the XXE attack surface.

Affected systems

pam_usb versions prior to 0.9.2 are affected. Systems running older versions on Linux distributions that package pam_usb (such as some Debian, Ubuntu, or Fedora installations) are at risk. Impact is confined to installations where pam_usb is actively configured and integrated into sudo or su authentication chains. Desktop and server environments using pam_usb as a hardware authentication factor are the primary scope.

Exploitability

Exploitation requires write access to /etc/pam_usb.conf or the configured pam_usb configuration file, which is owned by root. This prerequisite significantly limits practical exploitation—an attacker must already have gained local write access or be able to escalate within the system. However, once configuration write access is obtained, no user interaction is required; the XXE payload executes automatically at next authentication attempt. The vulnerability does not require a privileged initial context to exploit, only the ability to modify the config file. Given the high privilege level required for initial file write, exploitability is rated as difficult but not impossible in supply-chain, insider, or multi-stage attack scenarios.

Remediation

Upgrade pam_usb to version 0.9.2 or later. This release addresses the XXE vulnerability by properly configuring xmlReadFile() to disable external entity processing. Administrators should also audit pam_usb.conf file permissions and ownership to ensure no unauthorized modifications have occurred. Consider implementing file integrity monitoring (FIM) on the configuration file to detect tampering. In high-security environments, restrict write access to the configuration file to a minimal set of administrators and monitor sudo/su logs for suspicious authentication patterns during the remediation window.

Patch guidance

Apply the patch by upgrading pam_usb to version 0.9.2 or later. Verify the upgrade through your distribution's package manager (apt, yum, dnf, etc.) or by compiling from the upstream source. After patching, restart any active pam_usb-authenticated sessions or reboot to ensure the new library is loaded. Test that sudo and su authentication still function as expected. Review release notes for any configuration changes between your current version and 0.9.2. If pam_usb is not actively used in your environment, consider whether the module can be safely removed to reduce the attack surface.

Detection guidance

Monitor system logs for unexpected file read attempts from sudo/su processes, particularly reads of sensitive files such as /etc/passwd, /etc/shadow, or SSH keys. Use auditd rules to log access to pam_usb.conf modifications. Check for outbound network connections initiated during authentication events using netstat or process-level network monitoring. File integrity monitoring (FIM) tools can alert on unauthorized changes to the configuration file. Review pam_usb.conf for unusual or suspicious XML entity declarations, especially DOCTYPE declarations with SYSTEM or EXTERNAL references. Correlation of such indicators with authentication logs may reveal active exploitation attempts.

Why prioritize this

Although the CVSS score is 6.7 (MEDIUM), this vulnerability warrants prompt attention due to its position in the authentication chain and setuid context. A successful XXE attack could compromise root-level file access or enable lateral movement. The moderate barriers to exploitation (requiring configuration file write access) do not eliminate the risk, especially in supply-chain or insider threat scenarios. Environments where pam_usb is critical to access control should treat this as higher priority. Organizations running older distributions that may bundle outdated pam_usb versions should schedule updates during the next maintenance window.

Risk score, explained

The CVSS 3.1 score of 6.7 reflects a medium-severity vulnerability with local attack vector (AV:L), high attack complexity due to the need for configuration file write access (AC:H), high privilege requirement (PR:H), and no user interaction (UI:N). The impact scope is changed (S:C) because the vulnerability can affect processes beyond pam_usb itself; confidentiality impact is high (C:H) due to potential file exfiltration, while integrity and availability impacts are lower (I:L, A:L). The score appropriately penalizes the high barrier to initial exploitation while acknowledging the serious consequences if the prerequisite (config file write) is met.

Frequently asked questions