Re: pam-u2f: problematic PAM_IGNORE return values in pam_sm_authenticate() (CVE-2025-23013)

[Matthias Gerstner <mgerstner () suse de>]

Hi Jacob,

On Wed, Jan 15, 2025 at 11:58:00PM -0600, Jacob Bachmeyer wrote:
> On 1/15/25 06:03, Matthias Gerstner wrote:
> > There exist utility modules that don't
> > actually authenticate but perform helper functions or enforce policy. An
> > example is the pam_faillock [8] module, which can be added to the
> > `auth` management group to record failed authentication attempts and
> > lock the account for a certain time if too many failed attempts occur.
> > This module will return `PAM_SUCCESS` when running in "preauth" mode and
> > if the maximum number of failed attempts has not been reached yet. In
> > such a case `PAM_SUCCESS` would become the overall authentication result
> > when pam-u2f returns `PAM_IGNORE`.
>
> This looks to me like a logic error in PAM.  Why are utility modules 
> that do not actually perform authentication returning PAM_SUCCESS 
> (indicating successful authentication(!)) instead of PAM_IGNORE or some 
> other "neutral" code?
>
> Is this a widespread misconfiguration?

I suppose libpam has no way of differentiating the "importance" or
purpose of the modules it runs. It could be argued that such utility
modules that don't actually authenticate should indeed not return
`PAM_SUCCESS`. From my experience PAM module implementations generally
return `PAM_SUCCESS`, though, if they deem their task successfully
completed. This makes sense from a single module's point of view,
naturally.

I could not find anything conclusive about this topic in the PAM
documentation and development guides. Actually not even about the exact
behavior and purpose of PAM_IGNORE.

For hardening purposes it could be a good idea to return something like
PAM_IGNORE in utility modules that implement `pam_sm_authenticate()`.
I'm not sure if I'm overlooking something here that might spoil the
idea, however. This is a discussion that could be continued on a PAM
development mailing list (but I couldn't find one after a quick search).

> Is there a keyword that causes PAM to treat failure as failure but
> ignore PAM_SUCCESS that should be used with those utility modules?

It looks like there is no keyword that feels natural for this purpose.
Technically it could be done using the extended PAM syntax in a way like
this:

    auth [success=ignore ignore=ignore default=bad] pam_my_utility.so [...]

So it could be handled on configuration level, but it would complicate
the often already pretty complex PAM stacks we see on Linux
distributions.

Cheers

Matthias

Attachment: signature.asc
Description: