CVE-2026-54411: Linux-PAM pam_userdb Timing Attack Password Recovery

Technical summary

CVE-2026-54411 exploits a timing side-channel in pam_userdb's plaintext comparison logic. The vulnerable code path activates when administrators set crypt=none, specify an unrecognized crypt method, or omit the crypt parameter entirely. The module then uses strncmp() or strncasecmp() to compare candidate passwords against stored plaintext credentials. Because the comparison is preceded by a length-equality check, an attacker observes two distinct timing leaks: (1) whether the candidate length matches the actual password length, and (2) at which byte position the first mismatch occurs in each attempt. By submitting many authentication requests and measuring response times, the attacker progressively narrows the character space for each position, eventually recovering the entire plaintext password. This attack is feasible because response-time variations, though small, accumulate across multiple attempts and are statistically distinguishable.

Business impact

Organizations relying on pam_userdb for authentication—particularly in containerized environments, embedded systems, or legacy deployments—face exposure of account credentials without triggering traditional intrusion detection. Successful password recovery enables lateral movement, privilege escalation, and persistence. The impact depends on the sensitivity of accounts protected by pam_userdb and the frequency of authentication attempts an attacker can drive. Systems in high-trust network segments or those requiring repeated re-authentication (such as frequent sudo prompts) are at greater risk. Financial services, healthcare, and critical infrastructure operators should prioritize assessment of pam_userdb usage in their environments.

Affected systems

Linux-PAM through version 1.7.2 is affected. The vulnerability is specific to deployments where pam_userdb is configured for plaintext password storage and comparison. This occurs when: (1) administrators explicitly set crypt=none, (2) they specify an unsupported or typo'd crypt algorithm, or (3) they deploy without a crypt parameter in the module configuration. Systems using pam_userdb with proper crypt settings (e.g., crypt=sha512) are not vulnerable. The vulnerability can be exploited by local users and by remote attackers able to drive repeated authentication attempts through a service that calls pam_userdb (e.g., SSH, FTP, or custom authentication daemons).

Exploitability

The attack requires repeated authentication attempts and the ability to measure response times with millisecond or sub-millisecond precision. Complexity is elevated (AC:H) because timing variations depend on system load, network latency, and hardware characteristics. However, once an attacker has identified a pam_userdb-protected service and confirmed plaintext mode is in use, the attack is automatable: submit candidates, record response times, apply statistical analysis, and iteratively refine guesses. Local attackers can more reliably measure timing; remote attackers must contend with network jitter but can overcome it through high-volume requests. The attack becomes more practical if the target account password is short or uses a limited character set.

Remediation

Upgrade Linux-PAM to the patched version (verify against official vendor advisories for availability and version number). For immediate mitigation, reconfigure pam_userdb to use a secure crypt method—crypt=sha512 or crypt=md5 are standard options—which forces the module to store and compare hashed passwords, eliminating the plaintext comparison path and the timing leak. Audit your PAM configuration files (typically in /etc/pam.d/) to identify any pam_userdb rules and verify they include an appropriate crypt parameter. Disable pam_userdb if it is not actively in use. Consider replacing it with modern alternatives such as LDAP, SSSD, or system user authentication if feasible.

Patch guidance

Monitor Linux-PAM's official repository and vendor advisories for patch releases. When available, apply updates promptly to systems running pam_userdb. Before patching, verify that your pam_userdb configurations already specify secure crypt settings—this reduces urgency but does not eliminate the need to patch for defense-in-depth. Test patches in a staging environment, particularly if pam_userdb is integrated into critical authentication workflows. After patching, consider re-running configuration audits to ensure no unencrypted pam_userdb rules have been introduced.

Detection guidance

Search your PAM configuration files (/etc/pam.d/*) for any lines containing 'pam_userdb.so' and check whether they include 'crypt=' followed by a strong hash algorithm (sha512, md5) or the 'crypt=none' or unrecognized method variants. Monitor authentication service logs for unusual patterns of rapid, repeated failed authentication attempts against the same account, which may indicate timing-based reconnaissance. Implement network-level rate limiting on authentication services to reduce an attacker's ability to submit high volumes of requests. Consider deploying timing-aware intrusion detection rules that flag suspicious clusters of authentication attempts with unusual temporal spacing.

Why prioritize this

This vulnerability merits MEDIUM priority despite a lower CVSS score because it enables practical, silent password recovery against plaintext-configured pam_userdb instances. Unlike memory corruption or code injection flaws, timing attacks do not trigger crash logs or obvious security alerts, making them particularly stealthy. Organizations must identify whether pam_userdb is in use and whether it is misconfigured before an attacker does. The remediation—adding a crypt parameter or upgrading—is straightforward, making swift action feasible. Delay increases the window for reconnaissance and exploitation.

Risk score, explained

The CVSS 3.1 score of 5.9 (MEDIUM, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects high confidentiality impact (passwords exposed) and network attack vector, balanced against elevated attack complexity (timing precision required, system-dependent variability) and the requirement for vulnerable configuration. The scope is unchanged (local authentication system only), and integrity and availability are unaffected by the vulnerability itself. The score appropriately weights the practical difficulty of executing the attack against the severity of successful exploitation. However, security leaders should recognize that timing attacks, once demonstrated, become more feasible as attacker tools improve; this suggests treating the risk as escalating over time.

Frequently asked questions