CVE-2025-24032

A flaw was found in the pam_pkcs11 Linux-PAM login module. If the cert_policy is set to none, which is the default value, then pam_pkcs11 will only check if the user is capable of logging into the token. This flaw allows an attacker to create a different token with the user's public data, for example, the user's certificate and a PIN known to the attacker. If no signature with the private key is required, the attacker can log in as a user with that created token.

This vulnerability is of moderate severity because it only applies when the configuration explicitly disables signature verification (cert_policy = none), which is not a secure best practice. The attack requires an adversary to create a fake token using the victim’s public certificate and a known PIN, but it does not compromise the private key itself. Since private key possession is typically required for strong authentication, systems enforcing proper certificate verification (including signature validation) remain unaffected. Additionally, RHEL is not vulnerable by default, further reducing the real-world impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict the cert_policy value to signature in the pam_pkcs11.conf configuration file (cert_policy = signature).