ArchLinux: 202106-16: pam-u2f: authentication bypass
Summary
Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the
pam-u2f configuration and the application used, could lead to a local
PIN bypass. This issue does not allow user presence (touch) or
cryptographic signature verification to be bypassed, so an attacker
would still need to physically possess and interact with the YubiKey or
another enrolled authenticator.
If pam-u2f is configured to require PIN authentication, and the
application using pam-u2f allows the user to submit NULL as the PIN,
pam-u2f will attempt to perform a FIDO2 authentication without PIN. If
this authentication is successful, the PIN requirement is bypassed.
Resolution
Upgrade to 1.1.1-1.
# pacman -Syu "pam-u2f>=1.1.1-1"
The problem has been fixed upstream in version 1.1.1.
References
https://www.yubico.com/support/security-advisories/ysa-2021-03/ https://github.com/Yubico/pam-u2f/issues/175 https://github.com/Yubico/pam-u2f/pull/180 https://github.com/Yubico/pam-u2f/commit/6059b057dd9b6d0164fc16f9422c0d728f902bb5 https://github.com/Yubico/pam-u2f/commit/1ffd435c9c26e8c3122ea121d3e0b55cb81b1a46 https://security.archlinux.org/CVE-2021-31924
Workaround
None.