A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pam-develUpgrade pam-docsUpgrade pam | Dec 4, 2024 | Oct 23, 2024 |
| Amazon Linux Ami 2 | — | Upgrade pam-debuginfoUpgrade pamUpgrade pam-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade pam-debuginfoUpgrade pam-docsUpgrade pam-debugsourceUpgrade pamUpgrade pam-devel | Aug 5, 2025 | Oct 18, 2024 |
| Debian | — | No solution existsUpgrade pam | May 15, 2025 | Oct 23, 2024 |
| Dell Powerstore Dsa2025342 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 2, 2025 |
| Dell Powerstore Dsa2026039 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Jan 6, 2026 |
| Gentoo Linux | — | Upgrade sys-libs/pam. | May 13, 2025 | Oct 23, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade pam | Mar 18, 2025 | Oct 23, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade pam | Feb 11, 2025 | Oct 23, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade pam | Feb 11, 2025 | Oct 23, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade pam | Mar 18, 2025 | Oct 23, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Jul 9, 2025 |
| Oracle_linux | — | Upgrade pam-docsUpgrade pam-develUpgrade pam | Nov 27, 2024 | Oct 18, 2024 |
| Redhat_linux | — | Upgrade pam-debugsourceUpgrade pamNo solution existsUpgrade pam-docsUpgrade pam-develUpgrade pam-debuginfo | Nov 27, 2024 | Oct 23, 2024 |
| Rocky_linux | — | Upgrade pam-debugsourceUpgrade pamUpgrade pam-debuginfoUpgrade pam-devel | Feb 5, 2026 | Dec 19, 2024 |
| Suse | — | Upgrade apparmor-parser-langUpgrade pam-devel-32bitUpgrade libapparmor1-32bitUpgrade pam_apparmor-32bitUpgrade apparmor-parserUpgrade libapparmor-develUpgrade pam-extraUpgrade ruby-apparmorUpgrade python3-apparmorUpgrade pamUpgrade apache2-mod_apparmorUpgrade pam-32bitUpgrade apparmor-utilsUpgrade pam-extra-32bitUpgrade pam-docUpgrade perl-apparmorUpgrade apparmor-abstractionsUpgrade apparmor-profilesUpgrade pam_apparmorUpgrade pam-develUpgrade apparmor-utils-langUpgrade apparmor-docsUpgrade libapparmor1 | Dec 5, 2025 | Nov 27, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Oct 23, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub