In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pam-u2f | Yubico | 1.0.7 (including) | 1.0.7 (including) |
| Pam-u2f | Ubuntu | bionic | * |
| Pam-u2f | Ubuntu | cosmic | * |
| Pam-u2f | Ubuntu | disco | * |
| Pam-u2f | Ubuntu | esm-apps/bionic | * |
| Pam-u2f | Ubuntu | esm-apps/xenial | * |
| Pam-u2f | Ubuntu | trusty | * |
| Pam-u2f | Ubuntu | xenial | * |