CVE-2025-24531

In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.

Weakness

A function or operation returns an incorrect return value or status code that does not indicate the true result of execution, causing the product to modify its behavior based on the incorrect result.

Affected Software

References

• https://github.com/OpenSC/pam_pkcs11/releases
• https://github.com/OpenSC/pam_pkcs11/security/advisories/GHSA-7mf6-rg36-qgch
• https://www.openwall.com/lists/oss-security/2025/02/06/3
• http://www.openwall.com/lists/oss-security/2025/02/06/3
• http://www.openwall.com/lists/oss-security/2025/02/06/7