Auth bypass in Yubico Pam-U2f
CVE-2021-31924
Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This issue does not allow user presence (touch) or cryptographic signature verification to be bypassed, so an attacker would still need to physically possess and interact with the YubiKey or another enrolled authenticator. If pam-u2f is configured to require PIN authentication, and the application using pam-u2f allows the user to submit NULL as the PIN, pam-u2f will attempt to perform a FIDO2 authentication without PIN. If this authentication is successful, the PIN requirement is bypassed.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (26.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 26.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Yubico Pam-U2f
- Fedoraproject Fedora — versions 34, 35
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.yubico.com/support/security-advisories/ysa-2021-03 (Vendor Advisory)
- developers.yubico.com/pam-u2f/ (Product, Vendor Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- security.gentoo.org/glsa/202208-11 (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-31924?
- CVE-2021-31924 is a medium-severity vulnerability in Yubico Pam-U2f, classified under Improper Authentication. CVSS score: 6.8/10. Published 2021-05-26.
- How severe is CVE-2021-31924?
- Medium severity. CVSS v3 base score is 6.8 out of 10.
- Is CVE-2021-31924 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.