A vulnerability has been discovered in pam-u2f which could allow a local attacker to bypass PIN entry.
|Package||sys-auth/pam_u2f on all architectures|
|Affected versions||< 1.1.1|
|Unaffected versions||>= 1.1.1|
Yubico pam-u2f is a PAM module for FIDO2 and U2F keys.
A logic issue in Yubico pam-u2f could result in the bypass of a PIN entry requirement when authenticating with FIDO2.
An attacker with local access to certain applications using pam-u2f for authentication could incorrectly successfully authenticate without entering the authentication PIN.
There is no known workaround at this time.
All Yubico pam-u2f users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-auth/pam_u2f-1.1.1"
August 10, 2022
August 10, 2022: 1