CVE-2025-24531

A flaw was found in pam_pkcs11. The pam_sm_authenticate function wrongly returns PAM_IGNORE in some communication errors with a smartcard or PKCS#11 token, such as a smartcard being removed or a hardware failure. In some specific PAM configurations, this return code allows the authentication process to continue without valid credentials, effectively granting unauthorized access to the system.

To exploit this flaw, an attacker needs to cause a communication failure between the system software and the smartcard hardware. Additionally, this issue is only exploitable if PAM is configured to allow smartcard login without a secondary password requirement. Due to these reasons, this vulnerability has been rated with a moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.